CVE-2026-17955: Google Chrome Payments XSS Vulnerability

CVE-2026-17955 Overview

CVE-2026-17955 is a user interface (UI) spoofing vulnerability in the Payments component of Google Chrome. The flaw stems from insufficient validation of untrusted input and affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this issue by serving a crafted HTML page that manipulates payment-related UI elements to mislead users. Chromium security classifies the severity as Low. The vulnerability is tracked under [CWE-20] (Improper Input Validation).

Critical Impact
A remote attacker can craft an HTML page that spoofs Chrome's payment interface, potentially deceiving users into approving fraudulent transactions or disclosing payment details.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Payments component
Downstream distributions that ship pre-151 Chrome/Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17955 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17955

Vulnerability Analysis

The vulnerability resides in the Payments subsystem of Google Chrome. Chrome's Payments component renders sensitive UI elements such as the Payment Request sheet and transaction confirmation prompts. Insufficient validation of untrusted input allows attacker-controlled data from a web page to influence these UI elements. The result is UI spoofing rather than direct code execution or memory corruption. Users who trust the spoofed interface may authorize payments or disclose credentials to an attacker-controlled origin.

Root Cause

The underlying weakness is [CWE-20] Improper Input Validation. Data supplied by a remote origin is not adequately sanitized or constrained before it influences rendering of the Payments UI. Because the Payments UI is treated as a trust boundary by end users, any attacker-controllable content that appears within it undermines the security guarantee the browser tries to provide.

Attack Vector

Exploitation requires a user to visit an attacker-controlled or compromised web page. The page delivers crafted HTML that leverages the Payments interface to display misleading content. No authentication is required, and the interaction is limited to normal web browsing. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor context. A public proof of concept is not available at the time of publication.

Detection Methods for CVE-2026-17955

Indicators of Compromise

Chrome desktop clients reporting versions earlier than 151.0.7922.72 in browser telemetry or asset inventories
User reports of unexpected or visually inconsistent payment prompts on untrusted sites
Outbound web traffic to newly registered domains hosting fake checkout or payment-request pages

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 151.0.7922.72
Correlate browser version telemetry with proxy and DNS logs to identify users on vulnerable builds visiting suspicious payment or e-commerce lookalike domains
Monitor phishing intelligence feeds for campaigns abusing Payment Request spoofing in Chromium browsers

Monitoring Recommendations

Enable browser management policies that report Chrome version and update status to a central console
Ingest web proxy and endpoint browsing telemetry into a SIEM to detect visits to typosquatted payment domains
Track user-reported phishing incidents involving payment prompts and pivot on referring URLs

How to Mitigate CVE-2026-17955

Immediate Actions Required

Update Google Chrome for Desktop to version 151.0.7922.72 or later on all managed endpoints
Force a browser relaunch through enterprise policy to ensure the patched binary is loaded
Verify that Chromium-based browsers used in the environment have absorbed the upstream fix

Patch Information

Google addressed CVE-2026-17955 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Administrators should confirm the deployed version is 151.0.7922.72 or newer. Additional technical context is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict access to untrusted or unclassified sites through web filtering until patching is complete
Educate users to validate the origin displayed in the address bar before entering payment details
Disable the Payment Request API through enterprise policy where the feature is not required

bash

# Verify Chrome version on Windows via PowerShell
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version