CVE-2026-17923 in Chrome
Summary
by MITRE • 07/30/2026
Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a policy enforcement failure in google chrome's enterprise security mechanisms that could allow remote attackers to circumvent intended navigation restrictions through carefully crafted domain names. The issue stems from inadequate validation of domain name handling within the browser's enterprise policy framework, specifically affecting versions prior to 151.0.7922.72. The flaw operates at the intersection of web browser security and enterprise access control systems where administrators configure restrictions to prevent users from accessing certain domains or content categories.
The technical implementation of this bypass involves manipulating domain name resolution or presentation within chrome's enterprise policy enforcement logic. Attackers can craft domain names that exploit ambiguities in how chrome processes and validates domain specifications, allowing them to navigate to restricted resources despite administrator-imposed blocks. This typically occurs when the browser fails to properly canonicalize or validate domain names during policy evaluation, creating a gap between intended restrictions and actual enforcement. The vulnerability operates at the application layer and leverages weaknesses in how chrome's enterprise policy engine processes domain-based access controls.
The operational impact of this vulnerability extends beyond simple policy circumvention, as it undermines the fundamental security posture of organizations relying on chrome enterprise policies for network access control. Administrators may believe users are blocked from accessing specific domains when in reality they can bypass these restrictions through the crafted domain name techniques. This creates a false sense of security and potentially exposes organizations to unauthorized access to sensitive resources, data exfiltration opportunities, or malicious site navigation that could lead to further compromise. The low severity classification does not diminish the potential for significant operational impact in enterprise environments where strict network controls are essential.
Organizations should immediately update to chrome version 151.0.7922.72 or later to remediate this vulnerability, as the fix addresses the core domain validation logic within the enterprise policy enforcement system. Additional mitigations include implementing network-level controls such as proxy server restrictions, dns filtering, and additional application control measures that provide defense-in-depth against similar policy bypass techniques. Security teams should also review existing enterprise policies to ensure proper configuration of domain restrictions and consider implementing monitoring for unusual navigation patterns that might indicate exploitation attempts. This vulnerability aligns with attack patterns described in the attack tree framework where policy enforcement bypasses represent common paths for adversaries seeking to circumvent security controls, particularly relevant to organizations managing large chrome deployments where consistent policy enforcement is critical for maintaining secure computing environments.
This issue demonstrates how seemingly minor validation gaps in enterprise browser security can create significant access control weaknesses. The vulnerability classification aligns with cwe-264 permission issues and represents a failure in the principle of least privilege enforcement within the browser's enterprise management capabilities. Organizations should treat this as a medium to high priority remediation item given its potential to undermine comprehensive network security policies and access control frameworks that depend on chrome's enterprise policy implementation for maintaining secure user environments.