CVE-2026-17871

Analyzed Analyzed - Analysis Complete

Inappropriate Passwords Implementation in Google Chrome

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17871

EUVD

EUVD-2026-50620

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an inappropriate implementation in Google Chrome's Passwords feature. It allows a remote attacker to trick a user into performing specific UI gestures on a crafted HTML page to leak data from other origins. The issue was fixed in Chrome version 151.0.7922.72.

Detection Guidance

Detection requires checking the installed version of Google Chrome. If the version is prior to 151.0.7922.72, the system is vulnerable. Use commands like 'google-chrome --version' or check via package manager (e.g., 'apt list --installed | grep chrome' on Debian/Ubuntu).

Impact Analysis

If exploited, this vulnerability could allow an attacker to access sensitive data, such as passwords or personal information, from other websites you visit. It requires user interaction, like clicking or dragging, to trigger.

Compliance Impact

This vulnerability involves data leakage of cross-origin information due to UI manipulation, which could potentially expose sensitive user data. While not explicitly detailed, such data exposure may impact compliance with GDPR (data protection) or HIPAA (health information privacy) if user data is mishandled or leaked.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later immediately. Disable automatic updates temporarily if needed, but prioritize patching. Avoid engaging with untrusted HTML pages or suspicious links until updated.

Hi! I’m here to help you understand CVE-2026-17871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70