CVE-2026-17994: Google Chrome Auth Bypass Vulnerability

CVE-2026-17994 Overview

CVE-2026-17994 is a navigation restriction bypass in the Media component of Google Chrome on Android. The flaw affects Chrome for Android versions prior to 151.0.7922.72. A remote attacker can exploit this issue by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to circumvent navigation restrictions that the browser normally enforces.

Google's Chromium project rated the security severity as Low. The vulnerability resides in the Media subsystem, which handles audio and video playback rendering within the browser. No public exploit code is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A remote attacker can bypass Chrome for Android navigation restrictions using a crafted HTML page, potentially enabling redirect-based attack chains or phishing.

Affected Products

Google Chrome for Android versions prior to 151.0.7922.72
Chromium-based Android browsers that inherit the affected Media component
Embedded Android WebView contexts sharing the vulnerable Chromium code

Discovery Timeline

2026-07-30 - CVE-2026-17994 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17994

Vulnerability Analysis

The vulnerability is classified as an inappropriate implementation flaw in the Media component of Chrome for Android. Chrome enforces navigation restrictions to prevent pages from redirecting users to unexpected destinations or navigating outside their allowed origin context. The Media subsystem in versions prior to 151.0.7922.72 fails to properly enforce these restrictions during specific media-related operations.

An attacker crafts an HTML page that leverages the flawed media handling logic to initiate navigations that the browser would normally block. Because the exploitation vector is a web page, no user interaction beyond visiting the attacker-controlled site is required. Google's Chromium project labeled the severity as Low, reflecting the limited direct impact compared to memory corruption or sandbox escape issues.

Root Cause

The root cause is an implementation defect within Chrome's Media component on Android. Navigation restriction checks are either skipped or applied incorrectly when specific media elements or media-related APIs trigger navigation. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack is delivered remotely through a crafted HTML page. A victim using Chrome for Android below version 151.0.7922.72 visits the malicious page, and the embedded media content triggers the bypass. The attacker can then navigate the browser context to a destination that navigation policy would otherwise block. This behavior can be chained with phishing or credential harvesting flows to increase realism. Refer to the Google Chrome Desktop Update announcement for release-channel details.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose because Google has not released technical details of the exploit path.

Detection Methods for CVE-2026-17994

Indicators of Compromise

Chrome for Android clients reporting a version string below 151.0.7922.72 in HTTP User-Agent headers
Unexpected cross-origin navigations originating from pages that embed <video>, <audio>, or Media Source Extensions content
Outbound HTTP requests to newly registered or low-reputation domains immediately after media playback events

Detection Strategies

Inventory Android endpoints and identify Chrome installations below the patched build 151.0.7922.72 using mobile device management telemetry
Correlate browser telemetry with proxy or DNS logs to identify redirect chains that follow media content requests
Monitor phishing detection systems for pages that embed media elements alongside login forms or credential prompts

Monitoring Recommendations

Track Chrome version distribution across the Android fleet and alert on devices lagging the current stable channel
Ingest web proxy and mobile browsing logs into a centralized analytics platform for correlation with threat intelligence feeds
Flag domains referenced by the Chromium Issue Tracker Entry or downstream advisories once details are disclosed

How to Mitigate CVE-2026-17994

Immediate Actions Required

Update Google Chrome on all Android devices to version 151.0.7922.72 or later through the Google Play Store
Enforce automatic app updates on managed Android devices via mobile device management policy
Audit any Android applications embedding WebView to confirm they consume a patched Chromium release

Patch Information

Google addressed the issue in Chrome for Android 151.0.7922.72. The fix ships through the stable channel; see the Google Chrome Desktop Update release notes for the corresponding rollout. Managed environments should confirm the update reaches all enrolled Android devices within their standard patch window.

Workarounds

Restrict browsing to trusted sites through mobile web filtering until all devices receive the patched Chrome build
Use an alternate browser that is not affected by this Chromium Media component defect on high-risk devices
Disable autoplay and media-triggered navigation behaviors through enterprise Chrome policy where supported

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 151.0.7922.72 or higher
# versionName=151.0.7922.72