CVE-2026-17917 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical shortfall in the discretionary access control mechanisms within Google Chrome for iOS, specifically affecting versions prior to 151.0.7922.72. The issue stems from inadequate policy enforcement that permits remote attackers to circumvent security controls through carefully crafted HTML content. Discretionary access control systems are designed to restrict access to resources based on the identity of users or processes, but this flaw allows unauthorized access patterns that should otherwise be blocked by the browser's security architecture.
The technical implementation flaw occurs within Chrome's iOS rendering engine where policy enforcement mechanisms fail to properly validate or enforce access restrictions when processing malicious HTML pages. This type of vulnerability falls under the CWE-250 category for "Execute Code with Unusual or Unconventional Privilege Level" and represents a breakdown in the principle of least privilege that should govern all access control systems. Attackers can exploit this weakness by crafting HTML content that manipulates the browser's permission model, potentially gaining access to restricted resources or capabilities that should be protected.
The operational impact of this vulnerability extends beyond simple information disclosure as it creates potential pathways for more severe attacks. Remote attackers could leverage this bypass to access sensitive user data, perform unauthorized operations within the browser context, or potentially escalate privileges further within the iOS environment. The low severity classification from Chromium does not reflect the actual risk level in practical deployment scenarios where such bypasses can enable more sophisticated attack vectors including data exfiltration, session hijacking, or privilege escalation attacks.
Security practitioners should prioritize immediate patching of affected Chrome for iOS installations to address this vulnerability. The mitigation strategy involves updating to version 151.0.7922.72 or later where proper policy enforcement has been restored. Organizations implementing security controls should also consider monitoring for suspicious HTML content and browser behavior patterns that might indicate exploitation attempts. This vulnerability aligns with ATT&CK technique T1059.001 for Command and Scripting Interpreter and represents a potential entry point for broader attack chains involving privilege escalation or data theft operations.
The root cause of this issue lies in the insufficient validation of access control policies within Chrome's iOS implementation, particularly in how it handles resource access requests from web content. Proper enforcement mechanisms should have validated all access attempts against defined security policies before granting any privileges, but this validation process failed to adequately protect against crafted HTML inputs. This breach of access control represents a fundamental failure in the browser's security architecture that could potentially allow attackers to bypass multiple layers of protection typically maintained by modern web browsers.