CVE-2026-17662 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical information disclosure flaw in Google Chrome's prefetch mechanism that existed prior to version 151.0.7922.72. The issue stems from inadequate policy enforcement within the browser's prefetch functionality, which is designed to pre-fetch resources that users might visit next to improve page load performance. When a malicious actor crafts a specially constructed HTML page, they can exploit this weakness to extract cross-origin data from other websites that the user has visited or is currently browsing. The vulnerability specifically affects how Chrome handles prefetch requests across different origins, creating a pathway for unauthorized data leakage that violates fundamental web security principles.
The technical implementation of this flaw involves the prefetch subsystem's failure to properly validate and enforce cross-origin restrictions when processing prefetch directives. Chromium's prefetch mechanism operates by analyzing HTML documents for prefetch hints and then attempting to fetch resources in the background. However, insufficient policy enforcement meant that these prefetch requests could bypass normal cross-origin security boundaries, allowing attackers to construct pages that would trigger prefetch operations against sensitive resources on other domains. This represents a violation of the same-origin policy that forms the cornerstone of web security architecture and aligns with CWE-284 access control vulnerabilities where insufficient restrictions allow unauthorized access to resources.
The operational impact of this vulnerability extends beyond simple data leakage, as it enables sophisticated cross-site tracking and information gathering attacks that can compromise user privacy and potentially expose sensitive data. Attackers could leverage this flaw to reconstruct user browsing patterns, identify visited websites, or even extract personally identifiable information from cross-origin resources that should normally be isolated. The high severity classification reflects the potential for significant privacy violations and the ease with which remote attackers can exploit this weakness through standard web-based attack vectors. This vulnerability directly impacts the browser's ability to maintain proper isolation between different origins and undermines the security model that protects users from malicious websites attempting to gather information about their online activities.
Mitigation strategies for this vulnerability require immediate patching of Chrome installations to version 151.0.7922.72 or later, which includes fixes to the prefetch policy enforcement mechanisms. Organizations should ensure comprehensive browser updates across all user devices and implement additional monitoring for suspicious prefetch activity patterns. The fix addresses the underlying policy enforcement gap by strengthening cross-origin validation checks within the prefetch subsystem and ensuring that prefetch requests properly respect origin boundaries. Security teams should also consider implementing network-level monitoring to detect unusual prefetch behavior that might indicate exploitation attempts, as this vulnerability demonstrates how legitimate browser features can be abused when proper security controls are absent. This case highlights the importance of maintaining robust security boundaries even in seemingly benign browser functionality and aligns with ATT&CK techniques related to information gathering and privilege escalation through browser-based attacks.