CVE-2026-17805 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical flaw in the content security policy implementation within Google Chrome's mobile browser on android platforms. The issue stems from inadequate enforcement mechanisms that allow malicious actors to circumvent intended navigation restrictions through carefully constructed html payloads. The vulnerability specifically affects versions prior to chrome 151.0.7922.72 and demonstrates a failure in the browser's security model to properly validate and enforce policy boundaries during web navigation operations.
The technical nature of this flaw involves the manipulation of chrome's internal policy enforcement systems that are designed to restrict certain navigation behaviors and prevent unauthorized access to restricted resources. When a crafted html page is loaded, the vulnerability allows attackers to bypass these protections through techniques that exploit weaknesses in how the browser processes navigation directives and policy validation checks. This represents a direct violation of chromium's security architecture where policy enforcement should act as a barrier against malicious navigation attempts.
From an operational perspective, this vulnerability creates significant risk for users who may encounter malicious websites designed to exploit this weakness. Attackers can craft html pages that appear legitimate while simultaneously bypassing chrome's built-in restrictions, potentially leading to unauthorized access to sensitive information or redirection to malicious sites. The medium severity classification reflects the potential for exploitation in real-world scenarios where users might inadvertently navigate to compromised pages.
The vulnerability aligns with common weakness enumerations such as cwe-693 which deals with protection mechanism failures and cwe-284 which addresses improper access control mechanisms. From an attack framework perspective, this issue maps to techniques described in the attack tree methodology where navigation bypass represents a path to privilege escalation or information disclosure. The flaw essentially allows attackers to perform unauthorized navigation operations that should be restricted by chrome's policy enforcement system.
Mitigation strategies should focus on immediate patching of affected chrome versions and implementation of additional monitoring for suspicious navigation patterns. Organizations should also consider deploying web application firewalls and content filtering solutions as additional layers of protection. The vulnerability highlights the importance of maintaining current browser versions and implementing robust security policies that include regular updates and monitoring for such policy enforcement failures. Users should be educated about the risks of visiting untrusted websites and the importance of keeping their browsers updated to prevent exploitation of known vulnerabilities in the chrome security model.