CVE-2026-17925 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents an insufficient implementation flaw in Google Chrome's cross-origin resource sharing mechanisms specifically affecting the Android version prior to 151.0.7922.72. The issue stems from improper handling of origin validation within the browser's rendering engine which allows malicious actors to craft HTML pages that can bypass the fundamental same origin policy protections designed to prevent unauthorized access between different web origins. The vulnerability falls under CWE-693 which describes protection mechanism failures where security controls are improperly implemented or bypassed. From an operational perspective this weakness could enable remote attackers to execute cross-site scripting attacks, potentially accessing sensitive data from other domains, performing unauthorized actions on behalf of users, or establishing persistent access points within victim environments. The low severity classification indicates that while the vulnerability exists, it does not typically lead to complete system compromise or privilege escalation.
The technical exploitation occurs through carefully constructed HTML content that manipulates how Chrome evaluates cross-origin requests and resource access permissions. Attackers can leverage this flaw to circumvent browser security boundaries that normally prevent scripts from one origin from accessing resources belonging to another origin. This type of vulnerability aligns with ATT&CK technique T1059 which involves executing malicious code through compromised web applications, and T1213 which covers data from information repositories accessed via browser-based attacks. The implementation issue specifically affects Chrome's handling of resource loading and permission checks when processing web content, particularly in scenarios involving nested frames or complex cross-origin interactions.
Organizations should prioritize updating affected Chrome installations to version 151.0.7922.72 or later to remediate this vulnerability. System administrators should also implement network monitoring to detect anomalous cross-origin traffic patterns that might indicate exploitation attempts. Additional mitigations include enforcing strict content security policies, implementing web application firewalls, and conducting regular security assessments of web applications that users interact with. The fix addresses the core issue by strengthening origin validation checks and ensuring proper enforcement of same origin policy boundaries. Security teams should also consider deploying browser hardening configurations that limit unnecessary cross-origin capabilities and monitor for suspicious activity related to resource loading from untrusted domains. This vulnerability demonstrates the importance of continuous security updates and proper implementation of web security controls in preventing exploitation of fundamental browser mechanisms.