CVE-2026-17762 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a cross-origin data leakage issue within the iOS version of Google Chrome browser, specifically affecting versions prior to 151.0.7922.72. The flaw stems from an inadequate implementation of cross-origin resource sharing policies and security boundaries that should normally prevent unauthorized data access between different origin domains. The vulnerability operates through a crafted HTML page that exploits improper handling of cross-origin requests, allowing malicious actors to extract sensitive information from other origins without proper authorization.
The technical nature of this vulnerability aligns with CWE-200, which covers "Exposure of Sensitive Information to an Unauthorized Actor," and represents a specific implementation gap in Chrome's security model for iOS platforms. The Chromium security severity classification of Medium indicates the potential for significant privacy implications while not reaching the highest risk categories. Attackers can leverage this weakness by constructing malicious web pages that trigger unintended data exposure through browser mechanisms that should normally enforce strict cross-origin isolation policies.
The operational impact of this vulnerability extends beyond simple information leakage to potentially compromise user privacy and session data across different websites. When users navigate to compromised pages, their browsers may inadvertently expose cookies, local storage data, or other sensitive information from previously visited sites that share the same origin domain. This creates a persistent risk for users who maintain active sessions with multiple services, as the vulnerability could enable attackers to harvest authentication tokens or personal data without direct user interaction beyond visiting the malicious page.
This cross-origin leakage mechanism operates through browser security boundaries that should normally prevent access to resources from different domains, highlighting a failure in Chrome's implementation of the same-origin policy enforcement. The iOS-specific nature of this vulnerability suggests implementation differences in how mobile Safari rendering engine interacts with Chrome's security controls, potentially due to platform-specific sandboxing or memory management approaches. The issue demonstrates how mobile browser implementations can introduce unique attack vectors not present in desktop counterparts.
Mitigation strategies should focus on immediate patching to version 151.0.7922.72 or later, which contains the necessary security fixes for this cross-origin data leakage issue. Users should also employ additional protective measures including regular browser updates, avoiding untrusted websites, and maintaining current security software. Network administrators should monitor for potential exploitation attempts and consider implementing web application firewalls that can detect and block suspicious cross-origin requests. The vulnerability underscores the importance of continuous security assessment for mobile browser implementations and highlights the need for robust testing of cross-origin security controls in platform-specific builds.
From an ATT&CK framework perspective, this vulnerability maps to technique T1566.002 for "Phishing with Social Engineering" and potentially T1071.001 for "Application Layer Protocol: Web Protocols." The attack chain typically involves delivering malicious HTML content through social engineering or compromised websites that exploit the browser's cross-origin handling mechanisms. Organizations should implement security awareness training to help users recognize potential phishing attempts that may leverage this vulnerability, while also maintaining up-to-date threat intelligence on similar cross-origin exploitation techniques.
The security implications extend to user trust and data integrity across web applications, as successful exploitation could enable attackers to build comprehensive profiles of user behavior and preferences across multiple services. This type of vulnerability demonstrates the ongoing challenges in implementing robust cross-origin security controls, particularly in mobile environments where resource constraints and platform-specific rendering engines can introduce subtle implementation gaps. Regular security audits and penetration testing focused on browser security boundaries remain essential for identifying similar vulnerabilities before they can be exploited in real-world scenarios.
This vulnerability serves as a reminder of the complex security landscape surrounding modern web browsers, where seemingly minor implementation flaws can create significant privacy risks. The mobile-specific nature of the issue emphasizes the need for comprehensive security testing across all platform variants and highlights how different operating system constraints can introduce unique attack vectors. Security professionals should monitor for similar cross-origin vulnerabilities in other browser implementations and maintain vigilance against exploitation techniques that target browser security boundaries rather than application-level weaknesses.
The remediation process requires not only updating Chrome to the patched version but also ensuring that users understand the importance of keeping their browsers current with security updates. The vulnerability demonstrates how mobile platforms can introduce unique security considerations that require specialized testing approaches, particularly when dealing with sandboxing mechanisms and platform integration. Organizations should consider implementing automated patch management systems to ensure timely deployment of security fixes across all browser installations, especially in environments where users may not regularly update their software manually.