Google Chrome CVE-2026-17755

Exploitation requires the victim to actively install an attacker-controlled Chrome extension (UI:R per CVSS vector). The attacker needs no authentication or elevated privileges to craft or distribute the extension (PR:N), and the delivery channel is network-based (AV:N), meaning distribution via web or email is sufficient. The critical limiting factor is user consent to install the extension - without this, the vulnerability cannot be triggered. Non-default Chrome enterprise policies that restrict extension installation (allowlists, managed device policies) would prevent exploitation entirely. No special browser configuration or server-side component is required beyond a standard Chrome installation running an affected version. The vulnerability does not affect Chrome instances where extension installation is policy-disabled or where the malicious extension has not been installed.

CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N accurately characterizes this as a limited-integrity, user-interaction-dependent issue. The mandatory UI:R metric - requiring the victim to actively install an attacker-controlled extension - is the primary risk-limiting factor and substantially reduces exploitability compared to drive-by vulnerabilities. The I:L impact reflects UI deception rather than data tampering or code execution. EPSS at 0.13% (3rd percentile) corroborates a very low real-world exploitation probability, and absence from CISA KEV confirms no observed active exploitation. Tags note 'Information Disclosure' but the CVSS vector assigns C:N, suggesting the primary impact is integrity-based UI confusion rather than data exfiltration - this minor inconsistency in the tagging should be noted. SSVC assessment: exploitation status 'none', automatable 'no' (requires social engineering), technical impact 'partial' - this issue is a low operational priority for patched environments but warrants prompt patching given Chrome's ubiquitous deployment footprint.

An attacker publishes or distributes a crafted Chrome extension - through social engineering, a phishing site, or a compromised third-party extension listing - and convinces a target user to install it. Once installed, the extension exploits the incorrect security UI rendering to spoof browser trust indicators, such as displaying a false padlock icon, misrepresenting a site's certificate status, or hiding permission grant notifications, thereby tricking the user into performing actions they believe are safe. No POC has been publicly identified, and the requirement for user-initiated installation limits opportunistic exploitation.