CVE-2026-17756 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical weakness in Google Chrome's presentation mode implementation that allowed attackers to circumvent intended navigation restrictions through carefully crafted HTML content. The issue affected versions prior to 151.0.7922.72 and specifically targeted the policy enforcement mechanisms that govern how presentations behave when users interact with them. The flaw exists within the browser's handling of presentation contexts where certain navigation restrictions should prevent users from accessing unauthorized content or navigating outside of designated boundaries.
The technical implementation involves a failure in Chrome's security model for presentation sessions, where the browser's policy enforcement system does not properly validate user interactions against established navigation constraints. When users engage with presentation mode, the browser should enforce strict boundaries to prevent access to external resources or unauthorized navigation paths. However, this vulnerability allowed attackers to craft HTML pages that could bypass these restrictions through specific combinations of DOM manipulation and presentation API calls.
From an operational perspective, this vulnerability could enable attackers to execute phishing attacks, redirect users to malicious websites, or expose sensitive information within presentation contexts. The medium severity classification reflects the fact that while remote code execution was not possible directly, the ability to bypass navigation restrictions created opportunities for social engineering attacks and information disclosure. Users who engaged with compromised presentation content could be unknowingly redirected to attacker-controlled sites or exposed to additional security risks.
The vulnerability aligns with CWE-693, which addresses protection mechanism failures in web browsers, specifically concerning inadequate access control enforcement during user interactions. It also maps to ATT&CK technique T1566, focusing on phishing attacks that leverage presentation mode as a delivery vector for malicious content. The flaw demonstrates how browser security models can be undermined when policy enforcement mechanisms are insufficiently implemented or tested against adversarial scenarios.
Mitigation strategies include immediate upgrade to Chrome version 151.0.7922.72 or later, where the vulnerability has been addressed through enhanced policy enforcement mechanisms. Administrators should also implement additional monitoring for presentation mode usage and consider restrictive browser policies that limit presentation API access. Security teams should review existing presentation workflows and ensure proper sandboxing of presentation content to prevent similar issues from occurring in other browser implementations or web applications that utilize similar presentation APIs.