Google Chrome CVE-2026-17740

Exploitation requires the victim to actively visit a crafted HTML page (UI:R - mandatory user interaction); drive-by exploitation without any navigation is not possible. Hardware acceleration must be enabled in Chrome (the default configuration) for ANGLE to participate in rendering and be reachable. No attacker-side authentication is required (PR:N). The vulnerability is constrained to Chrome versions prior to 151.0.7922.72 on any supported desktop platform. Exploitation is further limited by Chrome's existing renderer sandbox and Site Isolation policies, which partition cross-origin content and may reduce the volume of data accessible through uninitialized reads. Impact is strictly limited to cross-origin confidentiality leakage (C:L); no integrity or availability consequences apply, and there is no scope change to underlying OS or other processes.

The CVSS 3.1 score of 4.3 (Medium) accurately captures the limited blast radius: the attack vector is network-delivered (AV:N) with no required authentication (PR:N), but mandatory user interaction (UI:R) and a scoped, confidentiality-only impact (C:L/I:N/A:N/S:U) constrain practical severity. The EPSS score of 0.23% at the 14th percentile signals low exploitation probability relative to other CVEs, and there is no CISA KEV listing or known POC code, which further reduces urgency. The real-world risk is primarily a browser privacy boundary violation rather than a system compromise vector - attackers gain only limited cross-origin data leakage, not code execution. For most organizations, this is a routine browser update priority rather than an emergency patch, though Chrome's ubiquitous deployment means aggregate user exposure is significant. No conflicts or contradictions between data sources are present.

An attacker serves a crafted HTML page containing malicious WebGL or HTML canvas operations designed to trigger an uninitialized buffer read within Chrome's ANGLE layer. When the victim navigates to the page in an unpatched Chrome instance, the attacker's JavaScript can extract residual pixel or buffer data from a previously rendered cross-origin frame, potentially disclosing sensitive content such as authentication tokens, session indicators, or rendered page content from another site. No public exploit code has been identified at time of analysis.