Google Chrome CVE-2026-17754

The victim must be running Google Chrome for desktop in any version prior to 151.0.7922.72 and must visit an attacker-controlled HTML page - this is the sole trigger condition. The CVSS PR:N vector confirms no authentication or privileges are required from the attacker. UI:R confirms exploitation cannot be triggered passively or silently; the victim must navigate to the crafted page, limiting the attack to social engineering vectors such as phishing emails, malvertising, or hijacked links. No non-default browser configuration is described as necessary - the flaw exists in Blink's default rendering behavior. Exploitation is constrained to integrity impact (C:N, A:N per CVSS): the attacker can influence cross-origin content but cannot directly exfiltrate data from other origins or cause denial of service under the current assessment. The non-automatable SSVC rating further confirms that bulk opportunistic exploitation is not viable without per-victim interaction.

The CVSS 6.5 base score derives from AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - a network-delivered attack of low complexity requiring no attacker privileges but mandating victim interaction (visiting a page), with scope unchanged and impact limited to integrity. This profile is internally consistent with a browser SOP bypass delivered via a crafted HTML page. EPSS at 0.22% (13th percentile) is low, and SSVC reinforces this: exploitation is 'none,' the attack is not automatable (UI:R prevents mass scanning exploitation), and technical impact is 'partial.' The absence of a CISA KEV entry confirms no confirmed active exploitation. The High integrity impact in CVSS is the most attention-grabbing signal, but it must be weighted against the requirement for user interaction, the low EPSS, and no observed exploitation - this is a genuine vulnerability worth patching promptly but does not warrant emergency response prioritization over other queued work.

An attacker registers an attacker-controlled domain and serves a crafted HTML page that exploits the Blink origin-validation flaw. A victim is directed to this page via phishing, malicious advertisement, or a compromised link - upon rendering, Chrome's Blink engine fails to enforce the same-origin boundary, allowing the attacker's page to access or manipulate content belonging to another origin loaded in the same browser session. No public proof-of-concept code has been identified at time of analysis, and exploitation requires the victim to actively navigate to the malicious page.