Google Chrome CVE-2026-17752

Exploitation requires the victim to run Google Chrome on macOS at a version below 151.0.7922.72 and to actively load an attacker-controlled or attacker-influenced HTML page (UI:R - user interaction is mandatory; there is no drive-by-without-visit path). No authentication is required (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L). Limiting factors: the bug is platform-scoped to the Mac build per the description; successful heap corruption depends on triggering the specific use-after-free in the Views component and, for code execution, on defeating Chrome's process sandbox and mitigations - consistent with Google's Medium severity rating and the low EPSS. It is not exploitable against a patched or auto-updated browser.

Signals are mixed and worth weighing carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated attack requiring user interaction (visiting a malicious page) with high confidentiality, integrity, and availability impact. However, Google's own Chromium severity rating is only Medium, and EPSS is low at 0.21% (11th percentile), indicating no observed exploitation momentum. This is not in CISA KEV and no public exploit code is identified, so real-world risk today is moderate rather than urgent. The gap between the high CVSS and the Medium Chromium rating and low EPSS suggests exploitability is non-trivial (memory-corruption UAFs often require additional sandbox escapes or heap-grooming primitives to weaponize). No SSVC decision data was provided in the input. Note the tags include 'Denial Of Service' while the description emphasizes exploitable heap corruption - the realistic worst case is code execution, with DoS as a lower bar.

An attacker hosts a crafted HTML page (or injects it via a malvertising frame) and lures a macOS Chrome user to open it; the page triggers the use-after-free in the Views subsystem, grooming the heap so the freed object is replaced with attacker-controlled data to corrupt memory and attempt code execution. Because UI:R is required, the victim must actively visit the page, and given AC:L the trigger itself is not complex once the user lands. No public POC is currently identified, and full weaponization would likely require chaining additional primitives.