CVE-2026-17974

Analyzed Analyzed - Analysis Complete

Insufficient Policy Enforcement in Google Chrome DevTools

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-20

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17974

EUVD

EUVD-2026-50900

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-602	The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

Executive Summary

This vulnerability is due to insufficient policy enforcement in Google Chrome's DevTools. A local attacker could exploit it by creating a specially crafted HTML page to bypass navigation restrictions, potentially gaining unauthorized access to certain features or data.

Detection Guidance

This vulnerability is specific to Google Chrome's DevTools and requires local access to exploit. Detection would involve checking the installed version of Google Chrome against the patched version (151.0.7922.72 or later). Use commands like 'google-chrome --version' or check via package manager (e.g., 'apt list --installed | grep google-chrome').

Impact Analysis

If exploited, this vulnerability could allow a local attacker to bypass navigation restrictions in Chrome, potentially accessing restricted pages or performing unauthorized actions. However, the severity is rated as Low, indicating limited impact.

Compliance Impact

This vulnerability involves insufficient policy enforcement in DevTools, allowing a local attacker to bypass navigation restrictions via a crafted HTML page. It does not directly impact compliance with standards like GDPR or HIPAA, as it is a local attack vector with low severity and no evidence of data exposure or privacy violations.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the insufficient policy enforcement in DevTools.

Hi! I’m here to help you understand CVE-2026-17974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70