Google Chrome CVE-2026-17743

The vulnerability is triggered when a user visits a crafted HTML page using an affected Chrome version (prior to 151.0.7922.72), making user interaction a hard prerequisite (UI:R from CVSS). The flaw specifically resides in the ControlledFrame component, meaning the attack surface is exposed when Chrome processes ControlledFrame-related functionality, which is most relevant in Isolated Web Apps and Chrome packaged app contexts. From the CVSS vector (PR:N), no authentication to the attacker's infrastructure is required. Exploitation is limited by the need for the victim to actively visit a malicious page and by the non-automatable verdict from SSVC, which indicates the attack cannot be reliably scripted for mass delivery. Non-default deployments relying on ControlledFrame features represent a higher-risk population than standard browser users.

The CVSS score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N signals a straightforward network-delivered integrity attack requiring only that a user visits a malicious page - low complexity and no privileges reduce the barrier significantly. However, the UI:R (user interaction required) constraint and S:U (no scope change) meaningfully limit automated mass exploitation. SSVC corroborates this: exploitation status is none, automatable is no, and technical impact is partial. EPSS at 0.22% (13th percentile) is notably low for a Chrome flaw, suggesting the security community does not currently expect widespread weaponization. No public exploit code exists and no KEV listing is present. The real-world priority should be moderate - patch promptly given Chrome's ubiquitous deployment footprint, but no emergency out-of-cycle patching is indicated by current signals. The absence of confidentiality impact (C:N) limits the flaw's utility for data exfiltration; the primary concern is cross-origin content manipulation.

An attacker hosts a crafted HTML page that exploits the insufficient policy enforcement in Chrome's ControlledFrame component. When a target user visits the page - via phishing link, malvertising, or compromised site - the browser fails to correctly enforce same-origin boundaries, allowing the attacker's page to write or manipulate content belonging to a different origin. No public exploit code exists at time of analysis, so exploitation requires original research into the specific ControlledFrame policy enforcement gap.