Listen to this Post
CVE-2026-17764 is a medium-severity vulnerability in Google Chrome’s Federated Credential Management (FedCM) API that allows a remote attacker to bypass the same-origin policy via a crafted HTML page. The flaw resides in the `NavigationInterceptor` component responsible for handling redirects during FedCM authentication flows.
When a navigation encounters a redirect, Chrome’s `NavigationRequest` updates its internal URL to the redirect target before notifying navigation throttles. The `NavigationInterceptor::ProcessRequest` method, which runs during WillRedirectRequest, then validates response headers against the target URL instead of the redirector URL. This inversion of validation logic is the core of the vulnerability.
In practice, an attacker crafts a page that initiates a FedCM identity flow. The navigation request is redirected through attacker-controlled endpoints. Because the same-origin policy checks are performed against the final destination rather than the origin that initiated the redirect, the attacker can smuggle cross-origin requests that appear to originate from a trusted site. The FedCM API, which mediates identity federation between relying parties and identity providers, trusts the validated origin to issue tokens and share user data. By subverting this check, an attacker can exfiltrate authentication tokens, impersonate users, or perform unauthorized actions on behalf of the victim.
The issue affects all Chrome versions prior to 151.0.7922.72. The Chromium security team assigned a Medium severity rating. The fix, committed on June 24, 2026, corrects the validation order and ensures that same-origin checks are applied to the redirecting origin. Additionally, a dangling pointer crash in the new tests was resolved by ensuring `NavigateAndCommit` is called before `MockFederatedAuthRequest` is created, as `NavigateAndCommit` destroys and replaces the document-associated data that `Request` holds a raw reference to.
Microsoft Edge (Chromium-based) is also affected as it ingests Chromium code. The vulnerability is remotely exploitable with low attack complexity, requires user interaction, and has a CVSS base score of 6.5 (Medium). The CWE associated is CWE-693: Protection Mechanism Failure.
DailyCVE Form:
Platform: ……. Google Chrome
Version: …….. < 151.0.7922.72
Vulnerability :…… Same-origin policy bypass
Severity: ……. Medium (CVSS 6.5)
date: ………. July 30, 2026
Prediction: ……. July 29, 2026
What Undercode Say:
Check current Chrome version google-chrome --version Verify FedCM API settings chrome://settings/content/federatedIdentityApi Monitor FedCM navigation interceptors (chromium source) git log --grep="FedCM NavigationInterceptor" --since="2026-06-01" Query NVD for CVE-2026-17764 curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-17764" | jq '.vulnerabilities[bash].cve' Check if patch is applied (Chromium commit hash) git show 2af692fec79c2041fcd939e82a8718fa00faabe2
Exploit:
An attacker hosts a malicious HTML page that initiates a FedCM authentication flow to a victim’s identity provider. The page uses the FedCM API to request an identity token. When the navigation request is redirected through attacker-controlled endpoints, the `NavigationInterceptor` validates response headers against the final redirect target instead of the original redirector URL. This allows the attacker to craft a response that appears to come from a trusted same-origin site, bypassing the same-origin policy. The attacker can then read sensitive identity tokens or perform cross-origin data exfiltration. Proof-of-concept code typically involves a crafted HTML page with `navigator.credentials.get()` using the FedCM protocol, combined with server-side redirect chains that exploit the validation flaw.
Protection:
- Update Chrome to version 151.0.7922.72 or later immediately.
- Enable automatic updates to ensure rapid patch deployment.
- Restrict FedCM API via enterprise policy (
FederatedIdentityApiEnabled) for managed devices. - Monitor network logs for unusual FedCM redirect chains.
- Apply Chromium patch (commit
2af692fec79c2041fcd939e82a8718fa00faabe2) if using custom Chromium builds. - Configure Content Security Policy to limit identity provider endpoints.
Impact:
- Confidentiality Impact: High — attacker can steal identity tokens and cross-origin data.
- Integrity Impact: High — attacker can impersonate users and perform unauthorized actions.
- Availability Impact: None — service disruption not observed.
- User Interaction: Required — victim must visit a crafted page.
- Attack Vector: Remote — exploitable over the network.
- Affected Users: All Chrome users prior to 151.0.7922.72, including Microsoft Edge users.
- Business Impact: Credential theft, session hijacking, and unauthorized access to federated identity systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
