Google Chrome CVE-2026-17730

Exploitation requires the target to be running Google Chrome prior to version 151.0.7922.72 with the Autofill feature enabled (enabled by default in all standard Chrome installations). The attacker must deliver a crafted HTML page to the victim - via phishing link, malicious advertisement, or compromised website - and must additionally convince or manipulate the victim into performing specific UI gestures on that page (the exact gestures are not publicly detailed in the available description). This UI:R dependency limits the attack to scenarios involving social engineering or deception. Exploitation does not require any authentication or elevated browser privileges (PR:N). The attack is bounded to cross-origin data leakage only; there is no code execution, integrity, or availability impact. Users with Autofill disabled or with no sensitive data stored in Chrome's Autofill profile have negligible exposure.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects network delivery at low complexity but with a critical limiting factor: UI:R. The attacker must convince the user to perform specific UI gestures, introducing a social engineering dependency that substantially reduces opportunistic exploitation. EPSS at 0.21% (11th percentile) corroborates low exploitation probability - this vulnerability is not being actively exploited at scale. No KEV listing confirms no confirmed active exploitation at time of analysis. No POC is referenced in the available data. The confidentiality impact is limited (C:L) and no integrity or availability effects apply. The realistic risk is highest for targeted attacks against individuals with sensitive Autofill data (e.g., saved payment cards or corporate addresses), not for broad opportunistic campaigns. Priority is moderate for enterprise Chrome deployments; patching is straightforward given vendor availability.

An attacker crafts a malicious HTML page with form elements designed to trigger Chrome's Autofill and observe side-channel signals (such as timing differences or DOM state changes) that reveal cross-origin data. The victim is lured to the page via phishing or malicious advertising and manipulated into performing specific UI interactions - such as clicking in form fields or pressing keyboard shortcuts - that activate Autofill. The attacker's page script reads the side-channel signals during these interactions to infer stored Autofill data (e.g., home address fields or partial card details) belonging to the victim, without the victim's awareness.