CVE-2026-17743

Undergoing Analysis Undergoing Analysis - In Progress

Insufficient Policy Enforcement in ControlledFrame in Google Chrome

Publication date: 2026-07-30

Last updated on: 2026-08-10

Assigner: Chrome

Description

Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-10

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17743

EUVD

EUVD-2026-50693

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient policy enforcement issue in ControlledFrame within Google Chrome versions before 151.0.7922.72. It allows a remote attacker to bypass the same origin policy by tricking a user into visiting a specially crafted HTML page.

Detection Guidance

This vulnerability is specific to Google Chrome versions prior to 151.0.7922.72. To detect it, check your Chrome version by running chrome://version/ in the browser. If your version is below 151.0.7922.72, the system is vulnerable. Update Chrome to the latest version to mitigate the issue.

Impact Analysis

This vulnerability could allow an attacker to access data or perform actions on websites you visit, potentially stealing sensitive information like cookies, session tokens, or personal data if you interact with the malicious page.

Compliance Impact

This vulnerability allows bypassing same origin policy, which could lead to unauthorized access to sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (health information privacy) by increasing risks of data breaches or unauthorized data exposure.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the insufficient policy enforcement in ControlledFrame.

Hi! I’m here to help you understand CVE-2026-17743. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70