CVE-2026-17664 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical security flaw in Google Chrome's loader component that existed prior to version 151.0.7922.72, demonstrating a failure in input validation that could be exploited by malicious actors who had already compromised the renderer process. The issue falls under the category of insufficient input validation, which is classified as CWE-20 by the Common Weakness Enumeration standard and aligns with ATT&CK technique T1059.001 for command and script injection. The vulnerability specifically affects how Chrome's loader handles untrusted input from HTML pages, creating a path for cross-origin data leakage when an attacker has already gained access to the renderer process.
The technical implementation of this flaw involves the loader component failing to properly validate or sanitize input received from web pages, particularly those crafted by malicious actors. When a compromised renderer process executes malicious HTML content, the inadequate validation allows attackers to manipulate the loader's behavior to extract sensitive data from different origins. This cross-origin data leakage occurs because the loader does not adequately enforce security boundaries that should prevent unauthorized access to resources belonging to other domains or origins. The vulnerability's severity is classified as high according to Chromium's security scoring system, indicating the potential for significant impact when exploited.
The operational impact of this vulnerability extends beyond simple data leakage, as it represents a privilege escalation vector that allows attackers who have already compromised the renderer process to gain additional access to sensitive information from other origins. Attackers could potentially extract cookies, session tokens, or other confidential data that should remain isolated between different web origins. This type of attack exploits the trust model within the browser's architecture where the renderer process is expected to be compromised but the loader component should maintain proper isolation. The vulnerability essentially undermines the same-origin policy enforcement mechanisms that are fundamental to web security and could enable more sophisticated attacks including credential theft or lateral movement within a user's browsing session.
Mitigation strategies for this vulnerability require immediate patching of Chrome installations to version 151.0.7922.72 or later, which would include the necessary fixes to strengthen input validation in the loader component. Organizations should also implement network monitoring to detect suspicious HTML content delivery and consider implementing additional security measures such as content security policies that further restrict cross-origin resource access. The fix likely involves enhancing the input validation routines within the loader to properly sanitize or reject malformed input that could lead to cross-origin data leakage, addressing the underlying CWE-20 weakness through proper boundary checking and data validation mechanisms. System administrators should also monitor for any attempts to exploit this vulnerability in their networks and ensure comprehensive browser update policies are in place to maintain protection against similar future threats.