CVE-2026-17977: Google Chrome CSS Policy Bypass Vulnerability

CVE-2026-17977 Overview

CVE-2026-17977 is a policy bypass vulnerability in the Cascading Style Sheets (CSS) implementation of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a victim. Google's Chromium security team rated the internal severity as Low.

The flaw undermines the same-origin policy enforcement within Chrome's CSS handling. Successful exploitation exposes sensitive data belonging to other origins loaded in the browser session.

Critical Impact
Remote attackers can leak cross-origin data from users who visit an attacker-controlled HTML page rendered by an unpatched Chrome build.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers that inherit the affected CSS code paths
Desktop Chrome stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17977 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17977

Vulnerability Analysis

CVE-2026-17977 is classified as a policy bypass affecting Chrome's CSS subsystem. The bug allows a remote attacker to circumvent cross-origin restrictions that normally isolate resources loaded from different origins. An attacker delivers a crafted HTML document that references cross-origin content in a manner the CSS engine mishandles.

The leak surfaces cross-origin data to attacker-controlled script or observable style state. This class of issue typically enables inference of protected content such as visited links, embedded document text, or resource metadata belonging to a different origin. The Google Chrome Update Announcement confirms the fix in the stable channel.

Root Cause

The root cause lies in insufficient policy enforcement within a CSS code path in Blink. The engine applies or exposes style-derived state across origin boundaries when it should block or opaque the operation. Full technical detail is restricted; refer to the Chromium Issue Tracker Entry once access is granted.

Attack Vector

Exploitation requires a victim to load a crafted HTML page under attacker control. The page issues CSS constructs that reference cross-origin resources. The browser processes them without enforcing the correct isolation, allowing the attacker to observe or exfiltrate cross-origin data. No user interaction beyond page navigation is required, and no authentication to the target origin is needed for the attacker.

No verified public proof-of-concept code is available. See the vendor advisory for technical detail once Google unrestricts the tracker entry.

Detection Methods for CVE-2026-17977

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in enterprise inventory telemetry.
Outbound requests from browser sessions to unfamiliar domains immediately after loading a third-party HTML page.
Unexpected cross-origin resource references (stylesheets, fonts, backgrounds) originating from low-reputation sites.

Detection Strategies

Inventory endpoints for installed Chrome versions and flag any host running a build below 151.0.7922.72.
Correlate web proxy logs with browser telemetry to identify HTML pages that trigger unusual cross-origin CSS fetches.
Deploy browser policy reporting to surface Content Security Policy (CSP) violations tied to cross-origin style access.

Monitoring Recommendations

Monitor Chrome auto-update status across managed fleets and alert on stalled update channels.
Track user navigation to newly registered or low-reputation domains that deliver HTML with heavy CSS references.
Ingest browser and proxy logs into a centralized analytics platform to hunt for cross-origin data exfiltration patterns.

How to Mitigate CVE-2026-17977

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Force a browser restart to ensure the patched binary is loaded into memory.
Verify Chromium-based third-party browsers have shipped an equivalent update and roll it out.

Patch Information

Google addressed CVE-2026-17977 in the stable channel release documented in the Google Chrome Update Announcement. Administrators should ensure Chrome auto-update is enabled and confirm the deployed version is 151.0.7922.72 or newer.

Workarounds

Restrict browsing to trusted sites via web proxy allowlists until patching completes.
Enforce strict Content Security Policy (CSP) headers on internally hosted applications to reduce cross-origin exposure.
Disable third-party stylesheet loading on sensitive internal portals where feasible.

bash

# Verify installed Chrome version on managed endpoints
google-chrome --version
# Expected output: Google Chrome 151.0.7922.72 or later