CVE-2026-17960: Chrome iOS Policy Bypass Vulnerability

CVE-2026-17960 Overview

CVE-2026-17960 is an insufficient policy enforcement vulnerability in Google Chrome for iOS. The flaw affects Chrome for iOS versions prior to 151.0.7922.72. A remote attacker can bypass the no-referrer policy by serving a crafted HTML page to a targeted user. Chromium's security team assigned this issue a Low severity rating.

The defect breaks an expected privacy control. The no-referrer referrer policy is designed to prevent the browser from sending the Referer header when navigating or issuing subresource requests. A successful bypass causes referrer information to leak to unintended destinations.

Critical Impact
Attackers can force Chrome for iOS to leak referrer data despite pages declaring a no-referrer policy, exposing origin URLs and query parameters to third-party destinations.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
Google Chrome for iOS Stable channel builds released before the fix
iOS devices running vulnerable Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17960 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17960

Vulnerability Analysis

The vulnerability resides in how Chrome for iOS enforces the referrer policy defined by web content. The no-referrer policy instructs the browser to omit the Referer HTTP header from all outbound requests originating from a document. Chrome for iOS fails to enforce this policy consistently for requests generated through a specific navigation or resource-loading path exposed by a crafted HTML page.

An attacker publishes an HTML page that triggers the vulnerable code path. When a victim visits the page in Chrome for iOS, the browser transmits referrer data that the policy should have suppressed. This exposes information the origin site expected to keep private, such as URL paths, tokens embedded in query strings, or intranet resource identifiers.

Unlike memory corruption issues, this defect does not enable code execution. Its impact is confined to confidentiality of referrer metadata. Chromium classified the severity as Low, reflecting the limited scope of the disclosure.

Root Cause

The root cause is incomplete enforcement of the Referrer Policy specification within Chrome's iOS-specific networking layer. The iOS build uses WKWebView primitives and Chrome-native networking components that must consistently apply the resolved referrer policy to every outbound request. A gap in that enforcement chain allows requests to carry a Referer header that should have been stripped.

Attack Vector

The attack requires a remote attacker to host or inject a crafted HTML page and convince a Chrome for iOS user to load it. No authentication, elevated privilege, or local access is needed. User interaction is limited to navigating to the attacker-controlled page. The realized impact is disclosure of referrer information rather than direct compromise of the device.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Google Chrome Stable Update release notes.

Detection Methods for CVE-2026-17960

Indicators of Compromise

Outbound HTTP requests from iOS devices containing a Referer header where the originating page declared a no-referrer policy via <meta name="referrer" content="no-referrer"> or an equivalent header.
Web server logs at attacker-controlled or third-party endpoints showing unexpected Referer values sourced from Chrome for iOS user agents on versions below 151.0.7922.72.

Detection Strategies

Inspect the User-Agent string of iOS Chrome traffic at web proxies and identify clients reporting a CriOS version below 151.0.7922.72.
Correlate outbound traffic from mobile endpoints with the referrer policy declared by internal web applications to identify policy bypass.
Review mobile device management (MDM) inventory data to enumerate iOS devices running vulnerable Chrome builds.

Monitoring Recommendations

Enable HTTP header logging at forward proxies to record Referer and User-Agent fields for mobile browser traffic.
Track Chrome for iOS version distribution across managed fleets and flag devices not on 151.0.7922.72 or later.
Monitor navigations from managed iOS Chrome browsers to newly registered or low-reputation domains.

How to Mitigate CVE-2026-17960

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store.
Push the update through mobile device management for all managed iOS devices.
Communicate the required minimum browser version to users who self-manage devices.

Patch Information

Google addressed CVE-2026-17960 in Chrome for iOS 151.0.7922.72. Details are documented in the Google Chrome Stable Update release notes and the associated Chromium Issue Tracker Entry. Apply the update by installing the latest Chrome for iOS build from the App Store.

Workarounds

Use an alternate iOS browser that correctly enforces referrer policies until Chrome is updated.
For sensitive internal web applications, avoid embedding tokens or identifiers in URLs so that any leaked Referer value discloses minimal data.
Enforce Strict-Transport-Security and rely on Referrer-Policy: no-referrer at the HTTP header level in addition to <meta> tags for defense in depth.

bash

# Example: enforce Referrer-Policy at the origin server (nginx)
add_header Referrer-Policy "no-referrer" always;