Google Chrome CVE-2026-17756

Exploitation requires that the victim is running Google Chrome prior to version 151.0.7922.72 and actively visits an attacker-controlled or attacker-influenced web page - user interaction is mandatory (UI:R per CVSS). The Presentation API is enabled by default in Chrome, so no non-default configuration is required. The attacker needs no credentials or prior access to the victim's system (PR:N). Exploitation is limited by the social engineering dependency: the attacker cannot silently push the exploit without a browsing action by the victim. SSVC's 'not automatable' classification confirms mass exploitation is not straightforward. The vulnerability is constrained to the browser's Presentation component and does not affect confidentiality or availability; the impact is scoped to navigation integrity within the browser session (S:U).

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) flags a network-reachable, low-complexity flaw requiring no attacker privileges, with high integrity impact - on paper a meaningful browser security control bypass. However, multiple secondary signals substantially moderate urgency. EPSS at 0.22% (13th percentile) indicates very low observed or modeled exploitation probability. SSVC independently rates exploitation as 'none,' automatable as 'no,' and technical impact as 'partial' - the 'partial' technical impact rating is notable given CVSS assigns I:H, suggesting SSVC analysts view real-world impact as more constrained than raw metrics imply. No CISA KEV listing and no reported POC further reduce operational priority. The non-automatable characterization is consistent with the UI:R requirement: mass drive-by exploitation is structurally harder. Net assessment: patch in the next standard browser update cycle; no emergency deployment warranted absent KEV change.

An attacker sets up a web page containing crafted HTML that exploits Chrome's insufficient policy enforcement in the Presentation component; when a victim using Chrome prior to 151.0.7922.72 visits or is social-engineered to visit the page, the browser's navigation restrictions are circumvented, potentially enabling the attacker to redirect the victim to otherwise-blocked destinations or inject content that should be policy-gated. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as 'none,' suggesting this remains unrealized in practice.