CVE-2026-17960 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a deficiency in Chrome for iOS's implementation of the HTTP referer policy enforcement mechanism, specifically affecting versions prior to 151.0.7922.72. The issue stems from inadequate validation of referrer policies within the browser's security framework, allowing malicious actors to circumvent intended privacy protections through carefully constructed web content. The vulnerability manifests when a crafted HTML page attempts to bypass the no-referrer policy that should prevent sensitive information from being transmitted in HTTP referer headers during navigation between pages.
The technical flaw resides in the browser's handling of referrer policy directives within the iOS implementation, where the security controls fail to properly validate or enforce the no-referrer policy as intended. This creates a potential information leakage scenario where user navigation patterns and potentially sensitive data could be transmitted to third-party domains through referer headers despite explicit policy declarations. The vulnerability operates at the application layer of the OSI model, specifically within the browser's HTTP request processing pipeline where referrer policy decisions are made.
From an operational impact perspective, this weakness allows remote attackers to gather information about user navigation patterns and potentially access sensitive data that should have been protected by the no-referrer policy. While classified as low severity by Chromium standards, the vulnerability represents a privacy concern that could be exploited in conjunction with other techniques to build comprehensive user profiling or track user behavior across different domains. The attack vector requires a crafted HTML page delivered through web-based channels, making it particularly concerning for web-based threat actors who can leverage this weakness in phishing campaigns or malicious websites.
The vulnerability aligns with CWE-693, which describes protection mechanism weaknesses, specifically focusing on insufficient enforcement of security policies within browser implementations. It also relates to ATT&CK technique T1566, which covers spearphishing attacks through web-based delivery mechanisms where attackers can exploit browser security gaps to gather intelligence or bypass protections. The issue demonstrates how mobile browser implementations can contain subtle differences from desktop counterparts that introduce unexpected security gaps.
Mitigation strategies include updating to Chrome for iOS version 151.0.7922.72 or later, which contains the necessary fixes for proper referrer policy enforcement. Organizations should also implement network-level monitoring to detect unusual referer header patterns and consider additional browser hardening measures such as disabling unnecessary features or implementing stricter content security policies. Users should be educated about the risks of visiting untrusted websites and the importance of keeping their browsers updated. Security teams should monitor for potential exploitation attempts through web-based traffic analysis and ensure that mobile device management policies include automatic browser update enforcement to minimize exposure windows.