Google Chrome CVE-2026-17742

Exploitation requires the victim to actively visit a crafted HTML page in an unpatched version of Chrome (prior to 151.0.7922.72), meaning a social engineering or malvertising delivery vector is necessary. The CVSS vector (UI:R) confirms that user interaction is a hard prerequisite. The vulnerability is specific to Chrome's Payments subsystem, which is active by default in Chrome and does not require any non-default configuration to be exploitable. Exploitation is limited to read-only cross-origin data disclosure (C:L only); there is no write, execute, or availability impact. Authentication to any service is not required to serve the malicious HTML, but the scope of data leaked is constrained to what the Payments subsystem can observe across origins.

CVSS 3.1 scores this at 4.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, reflecting network delivery, low complexity, no required privileges, but mandatory user interaction and only limited confidentiality impact. EPSS is 0.21% at the 11th percentile - well below the threshold for anticipated near-term mass exploitation. There is no CISA KEV listing and no known public exploit code. The attack requires the victim to visit a specifically crafted HTML page, which materially reduces opportunistic exploitation. The overall real-world risk is low-to-moderate: the vulnerability does not enable code execution, has no integrity or availability impact, and requires user interaction - making it a lower operational priority compared to higher-severity Chrome RCEs. However, Chrome's ubiquitous deployment means even low-probability exploitation against a large user base can yield meaningful aggregate data exposure. No conflicting signals exist between CVSS and description; both consistently indicate a constrained, user-interaction-dependent, read-only data disclosure.

An attacker hosts a specially crafted HTML page that triggers the Payments subsystem in Chrome to perform cross-origin operations without proper origin validation. When a victim user visits the page - via phishing link, malicious ad, or compromised site - Chrome's Payments policy enforcement is bypassed, leaking limited data belonging to a different origin to the attacker-controlled page. No exploit code is publicly available at time of analysis, and the attack is constrained to scenarios where the victim can be directed to the malicious page.