CVE-2026-17904 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical weakness in the Android version of Google Chrome's NFC implementation that stems from inadequate policy enforcement mechanisms. The flaw exists within the browser's handling of near-field communication protocols when processing crafted HTML content, allowing malicious actors to exploit cross-origin data leakage through NFC interactions. The security issue specifically affects versions prior to 151.0.7922.72 where proper sandboxing and origin isolation controls were insufficient to prevent unauthorized data access patterns.
The technical implementation of this vulnerability involves the improper handling of NFC communication channels within the browser's rendering engine when executing malicious HTML pages. When a user visits a specially crafted webpage, the browser fails to properly enforce the same-origin policy constraints that typically protect against cross-domain data access. This allows an attacker to manipulate NFC operations to extract information from different origins, effectively bypassing the fundamental security boundaries that separate web applications and their data repositories. The flaw operates at the intersection of web platform APIs and hardware-level NFC communication protocols, creating a dangerous gap in Chrome's security architecture.
The operational impact of this vulnerability extends beyond simple data leakage, as it provides attackers with potential access to sensitive information that might otherwise remain protected by standard browser security models. An attacker could craft pages that, when visited by users with NFC capabilities, silently extract data from other origins or even interact with NFC-enabled devices in unauthorized ways. This creates a vector for cross-origin information disclosure attacks that could potentially lead to credential theft, session hijacking, or access to personal data stored on NFC-enabled applications or devices. The low severity classification belies the potential for significant damage when combined with other attack vectors or when targeting specific high-value victims.
Mitigation strategies should focus on updating to the patched version 151.0.7922.72 or later where proper policy enforcement mechanisms have been implemented to prevent cross-origin NFC data access. Organizations should also implement network-level monitoring to detect unusual NFC-related traffic patterns and ensure that users are educated about visiting suspicious websites. The vulnerability aligns with CWE-693, which addresses protection mechanism failures in web applications, and maps to ATT&CK technique T1566 for initial access through malicious HTML content. Additional defensive measures include implementing strict Content Security Policy headers and disabling NFC features when not required for specific applications. System administrators should also consider deploying browser hardening configurations that restrict NFC API access to trusted origins only, while security teams should monitor for indicators of compromise related to NFC-based data exfiltration attempts.