CVE-2026-17997: Google Chrome Information Disclosure Flaw

CVE-2026-17997 Overview

CVE-2026-17997 affects Google Chrome versions prior to 151.0.7922.72. The flaw is an inappropriate implementation in the Passwords component. A remote attacker who has already compromised the renderer process can leak cross-origin data through a crafted HTML page. Chromium security engineers rated the severity as Low.

The vulnerability requires a prior compromise of the renderer process, which limits standalone exploitation. Attackers typically chain this class of issue with a renderer exploit to break the same-origin policy. Google addressed the issue in the Stable channel update for desktop.

Critical Impact
Cross-origin data leakage from a compromised renderer, enabling attackers to read sensitive data belonging to other web origins including credential-related material handled by the Passwords component.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the affected Passwords implementation
Downstream browsers that have not merged the upstream fix

Discovery Timeline

2026-07-30 - CVE-2026-17997 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17997

Vulnerability Analysis

The vulnerability resides in the Passwords component of Google Chrome. An inappropriate implementation allows a compromised renderer process to access data that should remain isolated across web origins. Browser security depends on strict enforcement of the same-origin policy, and the Passwords subsystem must isolate credential-related state between sites.

Because the flaw requires a prior renderer compromise, it functions as a secondary primitive in a multi-stage exploit chain. Adversaries who already hold code execution inside a sandboxed renderer can use the flaw to escalate their access to data belonging to unrelated origins. This category of issue is commonly tracked as an Information Exposure weakness.

Root Cause

The root cause is an inappropriate implementation in how the Passwords component handles cross-origin boundaries. The advisory from Google does not disclose the specific code path. Additional context is available in the Chromium Issue #521476960 tracker once access is granted.

Attack Vector

Exploitation requires two conditions. First, the attacker must already control the renderer process, typically through a separate memory-corruption or logic bug. Second, the attacker delivers a crafted HTML page that triggers the flawed logic in the Passwords component. The result is disclosure of cross-origin data to the attacker-controlled renderer.

No standalone remote code execution path exists in this CVE. Refer to the Google Chrome Stable Update advisory for release-level details.

Detection Methods for CVE-2026-17997

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 in the enterprise fleet
Unexpected child renderer processes exhibiting anomalous cross-origin network requests
Browser telemetry showing renderer crashes preceding suspicious outbound HTTP requests to attacker infrastructure

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.72
Monitor for renderer process anomalies that correlate with visits to untrusted domains
Alert on browser processes spawning outbound connections to newly registered or low-reputation domains shortly after page loads

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize version and extension telemetry
Ingest browser process events into the SIEM and correlate against threat intelligence feeds
Track user reports of unexpected credential prompts or autofill behavior that may indicate exploitation attempts

How to Mitigate CVE-2026-17997

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
Force browser restart through enterprise policy to ensure the patched binary is loaded
Audit Chromium-based derivative browsers and apply upstream fixes as vendors release them

Patch Information

Google released the fix in the Chrome Stable channel update covering version 151.0.7922.72. Deploy the update through Google Update, Chrome Enterprise, or the appropriate package management system. Details are documented in the Chrome Releases blog.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patching completes
Disable password autofill and saved credentials in Chrome policy for high-risk user groups pending patch deployment
Enforce site isolation and strict cross-origin policies through Chrome Enterprise configuration

bash

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Linux/macOS master_preferences)
# Set the required minimum version through Group Policy on Windows or the equivalent JSON policy file:
#   /etc/opt/chrome/policies/managed/chrome_version_policy.json
{
  "BrowserSwitcherEnabled": false,
  "PasswordManagerEnabled": false,
  "URLAllowlist": ["https://*.corp.example.com"],
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 3600000
}