CVE-2026-17825

chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords

Published Jul 30, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

The issue is an insufficient policy enforcement flaw in the password subsystem of Google Chrome on Android. A crafted HTML page can exploit this weakness, allowing a remote attacker to bypass discretionary access controls and read or modify stored credentials. The vulnerability is classified as CWE‑1220 and CWE‑284, reflecting an access‑control weakness that grants unauthorized data access.

Affected Systems

All users running Google Chrome on Android with a build older than 151.0.7922.72 are vulnerable, as the flaw exists only in versions prior to that release.

Risk and Exploitability

The CVSS score of 6.5 signals a medium severity flaw. An EPSS score of < 1% indicates that exploitation is considered unlikely but not impossible. The CVE is not listed in CISA’s KEV catalog, suggesting no widespread attacks have been reported. The likely attack vector is a malicious HTML page that a user visits; no additional user interaction beyond normal browsing is required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`151.0.7922.72`	affected	< 151.0.7922.72

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[151.0.7922.72,151.0.7922.72)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest Google Chrome update (151.0.7922.72 or later) via the Play Store.
Disable password storage in Chrome by navigating to Settings → Passwords and turning off the option to offer to save passwords.
Clear any existing stored passwords once the update is installed to eliminate sensitive data that could be exposed while the vulnerability exists.

Generated by OpenCVE AI on August 2, 2026 at 06:39 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4710-1	chromium security update
Debian DSA	DSA-6408-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.286% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html
https://issues.chromium.org/issues/517675979
https://nvd.nist.gov/vuln/detail/CVE-2026-17825
https://www.cve.org/CVERecord?id=CVE-2026-17825

History

Jul 31, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Jul 31, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords
Weaknesses		CWE-1220
References		https://nvd.nist.gov/vuln/detail/CVE-2026-17825 https://www.cve.org/CVERecord?id=CVE-2026-17825
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}` threat_severity `Moderate`

Jul 30, 2026 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jul 30, 2026 1:00 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
References		https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html https://issues.chromium.org/issues/517675979