CVE-2026-17859 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical cross-origin data leakage issue within the favicon handling mechanism of google chrome browsers. The flaw exists in how the browser processes favicon requests and responses, specifically when dealing with cross-origin resources. A remote attacker can exploit this by crafting a malicious html page that attempts to load favicons from different origins, potentially exposing sensitive information through the favicon loading process. The vulnerability stems from inadequate sanitization of cross-origin favicon requests, allowing unauthorized data exfiltration between different domains.
The technical implementation flaw manifests in the browser's favicon processing pipeline where it fails to properly enforce cross-origin resource sharing policies when retrieving favicon images. This occurs during the automatic favicon fetching behavior that browsers perform when navigating to web pages, particularly when the favicon.ico file is not explicitly defined in the html head section. The vulnerability allows attackers to construct specific html payloads that can trigger favicon requests to external domains, potentially capturing cookies, session information, or other cross-origin resources that should be restricted by browser security policies.
The operational impact of this vulnerability extends beyond simple data leakage and represents a significant threat to user privacy and application security. Attackers could leverage this flaw to perform cross-site request forgery attacks, cookie theft, or gather sensitive information about users' browsing habits and connected services. The medium severity classification reflects the potential for sophisticated attacks that could be combined with other vulnerabilities to create more severe security breaches. This issue particularly affects users of older chrome versions where the fix has not yet been implemented.
Mitigation strategies should include immediate deployment of google chrome version 151.0.7922.72 or later which contains the necessary patches to address this vulnerability. Organizations should also implement web application firewalls and content security policies that restrict favicon loading from untrusted origins. Additionally, browser hardening measures such as disabling automatic favicon fetching or implementing strict cross-origin policies can provide additional protection layers. Security teams should monitor for any related exploitation attempts and consider implementing network-level controls to detect unusual favicon request patterns that might indicate attempted exploitation. This vulnerability aligns with CWE-200 - Exposure of Sensitive Information and could be categorized under ATT&CK technique T1566.001 - Phishing: Spearphishing Attachment for exploitation methods.
The fix implemented by google chrome developers addresses the core issue in how favicon requests are processed across origin boundaries, ensuring that proper cross-origin restrictions are enforced during the automatic favicon loading process. This update reinforces the browser's security model and prevents unauthorized data access through seemingly benign favicon requests. Organizations should verify their chrome installations are updated and consider additional security measures such as monitoring for unusual favicon-related network activity that could indicate attempted exploitation of this vulnerability.