Google Chrome CVE-2026-17757

Exploitation requires that a victim user actively navigate to an attacker-controlled or compromised web page using Google Chrome prior to version 151.0.7922.72 - user interaction (UI:R per CVSS) is mandatory and is the primary limiting factor reducing mass exploitation risk. The attack is delivered entirely via a crafted HTML page with no special Chrome configuration, command-line flag, or non-default setting required. Impact is strictly limited to confidentiality (C:L) - specifically leaking cross-origin data readable by the renderer process - with no integrity or availability impact. The vulnerability cannot be triggered server-side, through passive network observation, or without the victim loading the malicious content in a vulnerable Chrome instance.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N captures the key risk trade-offs well. The attack is network-accessible with no privilege requirement, but the mandatory user interaction (UI:R) and limited confidentiality impact (C:L) substantially reduce urgency compared to no-click browser RCE classes. EPSS at 0.23% (14th percentile) is consistent with the absence of a CISA KEV listing and no confirmed public POC, suggesting this has not attracted active exploitation tooling. There is no integrity or availability impact. The Chromium security team's own 'Medium' severity rating aligns with this assessment. Real-world risk is moderate for targeted attack scenarios - an adversary could craft a page to leak session tokens or rendered page fragments from a privileged tab - but mass exploitation is unlikely given the UI:R requirement and low EPSS.

An attacker hosts a crafted HTML page that triggers specific Skia rendering operations - such as canvas draw calls or CSS compositing - designed to read from uninitialized graphics memory buffers. When a victim running Chrome prior to 151.0.7922.72 navigates to this page, the Skia engine processes the crafted operations and exposes residual memory bytes that may contain cross-origin data from another rendered tab or frame, which attacker-controlled JavaScript can then exfiltrate. No public proof-of-concept exploit code has been identified at time of analysis.