Google Chrome CVE-2026-17753

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 with the Autofill feature enabled (the default configuration). The attacker must be able to deliver a crafted HTML page to the victim, either by controlling a website the victim visits or through a phishing/malvertising redirect. Active user interaction is required - the victim must navigate to the malicious page; drive-by exploitation without any user action is not possible per the CVSS UI:R metric. Exploitation is limited to confidentiality impact only (cross-origin data exposure); no code execution or integrity manipulation is possible through this flaw alone. Non-Chrome browsers and Chrome instances with Autofill explicitly disabled are not affected.

The CVSS 3.1 base score of 4.3 (Medium) is consistent with the impact profile: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with only limited confidentiality impact (C:L) and no integrity or availability impact. The UI:R requirement is a meaningful real-world friction point - the victim must actively visit an attacker-controlled or compromised page. EPSS at 0.21% (11th percentile) corroborates low exploitation probability; this vulnerability has not attracted automated exploit development attention. There is no CISA KEV listing and no reported public proof-of-concept code, further reducing urgency. The primary risk is targeted phishing or malvertising scenarios where an attacker can reliably direct Chrome users to a crafted page. Given Chrome's ubiquitous deployment, the aggregate exposure is broad, but the per-instance impact is limited to partial data leakage (e.g., autofilled form field values), not full credential theft or code execution. Overall: low operational priority for patched environments; moderate priority for organizations with delayed Chrome update cycles.

An attacker registers a convincing domain and hosts a crafted HTML page containing form fields engineered to trigger Chrome's Autofill feature and exfiltrate cross-origin autofill-populated values via JavaScript. The victim is lured to the page through phishing email or malicious advertisement; upon page load and Autofill interaction, sensitive data such as address or payment field values is silently transmitted to the attacker's server. No public proof-of-concept code has been identified, meaning this scenario requires non-trivial Autofill internals knowledge to replicate.