CVE-2026-17720 Google CVE debrief

Who should care

Google Chrome users, particularly those with sensitive cross-origin data, should be aware of this vulnerability and take steps to update their browsers and monitor for potential attacks. Additionally, security teams and administrators responsible for managing Google Chrome deployments should prioritize updating to version 151.0.7922.72 or later to address the insufficient policy enforcement vulnerability. Operators of platforms that utilize Google Chrome should review their exposure and ensure that compensating controls are in place for exposed systems while remediation is scheduled and verified. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset owners should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. IT teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for source tracking should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Those in charge of asset inventory should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Teams responsible for rollback/change windows should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for exposure review should review compensating controls for exposed systems while remediation is scheduled and verified. Those in charge of monitoring should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for compensating controls should review compensating controls for exposed systems while remediation is scheduled and verified. Those in charge of vendor patch guidance should confirm whether affected product deployments exist in managed environments,

Technical summary

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. The vulnerability has a High Chromium security severity, but a Low CVSS score of 3.1, indicating a Low severity. This issue affects Google Chrome users who have not updated to version 151.0.7922.72 or later. The vulnerability is related to the Passwords component of Google Chrome, and attackers can exploit it by crafting a malicious HTML page.

Defensive priority

Google Chrome users should prioritize updating to version 151.0.7922.72 or later to address the insufficient policy enforcement vulnerability.

Recommended defensive actions

• Update Google Chrome to version 151.0.7922.72 or later
• Review and enforce strong password policies
• Monitor for suspicious activity related to cross-origin data leaks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates that insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. The Chromium security severity is High, but the CVSS score is 3.1, indicating a Low severity. Limited information is available about the specific impacts and affected scope.

Official resources