Google Chrome CVE-2026-17759

Exploitation requires that the victim actively visits an attacker-controlled or compromised HTML page using a vulnerable version of Chrome (prior to 151.0.7922.72); this is reflected in UI:R of the CVSS vector. No authentication to any service is required (PR:N), and attack complexity is low (AC:L), meaning no race condition or special configuration is needed beyond the user interaction. Exploitation is limited to the Chrome renderer process sandbox (S:U, unchanged scope), so a sandbox escape would be required to affect the underlying OS. Only the confidentiality of in-process memory is at risk - there is no integrity or availability impact. Non-desktop Chrome variants (Android, iOS) are not referenced in the CPE or advisory and should be verified separately.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting that exploitation is straightforward once a user visits the attacker's page, but user interaction is a meaningful barrier. EPSS of 0.23% at the 14th percentile strongly suggests this flaw is not being broadly targeted in the wild, and it does not appear in the CISA KEV catalog, confirming no confirmed active exploitation at time of analysis. The C:H impact rating is the primary risk driver - leaked process memory in a browser can contain high-value data - but the S:U (unchanged scope) constrains the blast radius to the browser's own process sandbox. Overall this presents a real but moderate priority: patch promptly given Chrome's ubiquitous deployment and the sensitivity of browser memory, but the low EPSS does not indicate emergency out-of-band response.

An attacker hosts a webpage containing a crafted media element - such as a malformed video or audio stream - designed to trigger the vulnerable codec processing path in Chrome. When a target user visits the page, Chrome's codec subsystem reads from an uninitialized memory buffer, and the page's JavaScript or timing side-channels may allow the attacker to infer fragments of that leaked process memory, potentially recovering session tokens or other sensitive data present in the renderer heap.