CVE-2026-17823 Google CVE debrief

Who should care

Administrators and users of Google Chrome, particularly those in environments where security and compliance are critical, should be aware of this vulnerability and take immediate action to patch or mitigate it. This includes reviewing and implementing the official patch to upgrade Google Chrome to version 151.0.7922.72 or later, monitoring Google Chrome installations for compliance with the patched version, and implementing compensating controls such as Web Application Firewalls (WAFs) to detect and prevent potential exploitation attempts. Additionally, security teams should review the vulnerability and assess the potential impact on their organization, and consider implementing additional security measures to protect against potential exploitation attempts. Users of Google Chrome should also be aware of the potential risks associated with this vulnerability and take steps to protect themselves, such as keeping their browser up to date and being cautious when clicking on links or downloading files from untrusted sources. IT teams should prioritize patching and mitigation efforts for this vulnerability, especially in environments where Google Chrome is widely used. Vulnerability management teams should also review the CVE record and assess the potential impact on their organization, and consider implementing additional security measures to protect against potential exploitation attempts. Asset owners should review the vulnerability and assess the potential impact on their assets, and consider implementing additional security measures to protect against potential exploitation attempts. Security operations teams should review monitoring, detection, and logs for exposed assets that need extra review. Change management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compliance teams should review the vulnerability and assess the potential impact on their organization's compliance posture, and consider implementing additional security measures to protect against potential exploitation attempts. Incident response teams should review the vulnerability and assess the potential impact on their incident  

Technical summary

Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allows a remote attacker to bypass same origin policy via a crafted HTML page. This vulnerability has a CVSS score of 6.5 and is classified as Medium severity. The vulnerability affects Google Chrome users who have not updated to version 151.0.7922.72 or later. It is recommended that administrators and users of Google Chrome take immediate action to patch or mitigate this vulnerability.

Defensive priority

Medium severity vulnerability in Google Chrome, requiring immediate attention to prevent potential same-origin policy bypass.

Recommended defensive actions

• Apply the official patch to upgrade Google Chrome to version 151.0.7922.72 or later.
• Monitor Google Chrome installations for compliance with the patched version.
• Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent potential exploitation attempts.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from official sources, including NVD and CVE.org, indicates a Medium severity vulnerability in Google Chrome prior to version 151.0.7922.72. The vulnerability is related to Insufficient policy enforcement in WebXR, allowing a remote attacker to bypass same origin policy via a crafted HTML page.

Official resources