CVE-2026-17961: Chrome Android Auth Bypass Vulnerability

CVE-2026-17961 Overview

CVE-2026-17961 is a navigation restriction bypass in the Session component of Google Chrome on Android. Versions prior to 151.0.7922.72 allow a remote attacker to bypass navigation restrictions using a crafted HTML page. Chromium classifies the security severity as Low.

The flaw stems from an inappropriate implementation in Session handling. An attacker who hosts a malicious page can influence navigation flow in ways the browser should have prevented. Exploitation requires the victim to visit attacker-controlled content in Chrome for Android.

Critical Impact
A remote attacker can bypass navigation restrictions in Chrome for Android via a crafted HTML page, potentially enabling phishing, spoofing, or unwanted redirection scenarios.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based Android browsers sharing the affected Session implementation
Downstream Android WebView consumers relying on the same code path

Discovery Timeline

2026-07-30 - CVE CVE-2026-17961 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17961

Vulnerability Analysis

The vulnerability is categorized by Chromium as an inappropriate implementation in the Session component. Session logic governs navigation history, session restore, and cross-navigation state. An incorrect enforcement path in this component allows navigation restrictions to be bypassed.

Chrome enforces navigation restrictions to prevent pages from initiating certain transitions without user consent. When Session handling deviates from these rules, an attacker can craft HTML that triggers navigation the browser should reject. The result is a client-side navigation control bypass rather than memory corruption or code execution.

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update. Additional context is tracked in Chromium Issue Tracker #517700791.

Root Cause

The root cause is an inappropriate implementation within Session in Chrome for Android. The Session component fails to enforce navigation restrictions consistently, permitting a crafted page to influence navigation state beyond what policy allows.

Attack Vector

The attack vector is remote and requires user interaction. A victim must load a crafted HTML page in Google Chrome on Android at a version prior to 151.0.7922.72. No authentication is required. Technical exploitation details are not published; see the referenced Chromium issue for further information.

Detection Methods for CVE-2026-17961

Indicators of Compromise

No public indicators of compromise are associated with this CVE at time of publication.
Unexpected redirects or navigation transitions originating from untrusted pages viewed on Chrome for Android.
User reports of URL bar or origin confusion on Android devices running Chrome versions earlier than 151.0.7922.72.

Detection Strategies

Inventory Android endpoints and identify Chrome versions below 151.0.7922.72 using mobile device management telemetry.
Monitor web proxy and DNS logs for user traffic to suspicious pages followed by anomalous redirect chains on Android user agents.
Correlate phishing report submissions with Chrome for Android user-agent strings to spot bypass abuse.

Monitoring Recommendations

Track Chrome for Android version distribution across the fleet and alert on installations below the patched build.
Ingest browser telemetry and proxy logs into a centralized data lake to enable historical hunting for suspicious navigation patterns.
Review threat intelligence feeds for weaponization signals tied to Chromium issue 517700791.

How to Mitigate CVE-2026-17961

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store.
Push managed Chrome updates via enterprise mobility management for corporate Android devices.
Communicate the update requirement to end users who manage their own devices under BYOD policies.

Patch Information

Google released a fix in the Chrome Stable channel update referenced in the Google Chrome Stable Update. Users on Android must upgrade to 151.0.7922.72 or later. Tracking information is available in Chromium Issue Tracker #517700791.

Workarounds

No vendor-supplied workaround is available; installing the patched Chrome build is the supported remediation.
Restrict browsing to trusted origins on unpatched Android devices until updates complete.
Enforce mobile browser update policies through enterprise mobility management to reduce time-to-patch.

bash

# Example: enforce a minimum Chrome for Android version via MDM policy JSON
{
  "com.android.chrome": {
    "managedProperty": [
      {
        "key": "MinimumVersion",
        "valueString": "151.0.7922.72"
      }
    ]
  }
}