CVE-2026-17996: Google Chrome Auth Bypass Vulnerability

CVE-2026-17996 Overview

CVE-2026-17996 is a navigation restriction bypass vulnerability in the Browser component of Google Chrome on macOS. Versions prior to 151.0.7922.72 contain an inappropriate implementation that allows a local attacker to bypass navigation restrictions using a malicious file. Chromium's security team rated the issue Low severity.

The flaw requires local access and a crafted file to trigger the bypass. Successful exploitation lets an attacker sidestep browser navigation controls that would normally block movement to restricted resources or origins.

Critical Impact
A local attacker with a malicious file can bypass Chrome's navigation restrictions on macOS, potentially enabling downstream browser-based attacks that rely on trusted navigation boundaries.

Affected Products

Google Chrome for macOS prior to 151.0.7922.72
Chromium-based browsers on macOS that inherit the affected Browser component
Stable channel desktop builds published before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17996 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17996

Vulnerability Analysis

The vulnerability resides in the Browser process implementation on macOS. Chrome enforces navigation restrictions to control which resources and origins a tab can load, especially when handling file:// URLs and OS-specific file types. On macOS versions prior to 151.0.7922.72, the implementation does not correctly enforce these restrictions when processing certain malicious files.

A local attacker who can place or deliver a specially crafted file to the target system can leverage this gap. The issue falls under the Business Logic Flaw and Improper Access Control category rather than a memory safety defect. Chromium classified the severity as Low, reflecting the local access requirement and constrained impact scope.

Root Cause

The root cause is an inappropriate implementation in Chrome's Browser component that governs navigation handling on macOS. The navigation enforcement path does not fully validate all conditions required to block restricted transitions when a malicious file is involved. Details beyond the public advisory are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires local delivery of a malicious file to the victim's macOS system. When the file interacts with Chrome, the browser fails to apply the expected navigation restriction, allowing the attacker to reach a restricted destination or context. No verified exploit code or public proof-of-concept has been published. Refer to the Google Chrome Update Announcement for vendor-provided context.

Detection Methods for CVE-2026-17996

Indicators of Compromise

Unexpected file:// scheme navigations initiated by Chrome on macOS endpoints
Presence of unfamiliar files in user download or temporary directories that are opened by Chrome
Chrome child processes launching from atypical parent processes on macOS

Detection Strategies

Inventory Chrome versions across macOS fleets and flag any installation below 151.0.7922.72
Correlate Chrome process telemetry with file open events to identify anomalous navigation triggered by local files
Monitor endpoint detection and response (EDR) telemetry for Chrome navigations that resolve to restricted origins or local resources

Monitoring Recommendations

Enable browser telemetry forwarding to a centralized log store for navigation and download events
Track patch compliance for Chrome and Chromium-based browsers via software inventory tooling
Alert on execution of downloaded files immediately followed by Chrome navigation activity

How to Mitigate CVE-2026-17996

Immediate Actions Required

Update Google Chrome on macOS to version 151.0.7922.72 or later on all managed endpoints
Verify auto-update is enabled and functioning for Chrome installations across the environment
Restrict the ability of untrusted users to place files on shared macOS systems

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Announcement. Upgrading Chrome on macOS to 151.0.7922.72 or higher remediates the vulnerability. Chromium-based browsers should be updated once their upstream vendors integrate the fix.

Workarounds

Limit local access to macOS endpoints and enforce least-privilege user accounts
Block delivery of untrusted files through email, web, and removable media controls
Educate users to avoid opening unsolicited files, particularly those that trigger browser navigation

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check via the built-in updater
open -a "Google Chrome" --args --check-for-update-interval=1