Google Chrome CVE-2026-17760

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 with the NoStatePrefetch feature active - this feature is enabled by default in affected Chrome versions, so no non-standard configuration is required on the victim's side. The victim must actively visit or be redirected to an attacker-controlled HTML page, as user interaction is mandatory per the CVSS UI:R metric. Per PR:N, no authentication to any service is required of the attacker. Key limiting factors are: the victim must navigate to the attacker's page (passive drive-by without any click is insufficient); the information leakage is constrained to side-channel inference of cross-origin data rather than direct exfiltration (C:L only); and no write access or denial of service is achievable through this flaw. Exploitation does not require any special network position or privileged access.

The CVSS 3.1 score of 4.3 (Medium) captures the key risk dimensions: network-delivered (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but mandating user interaction (UI:R), with impact limited to partial confidentiality loss (C:L) and no integrity or availability consequence. EPSS at 0.21% - 11th percentile - strongly signals this is unlikely to be mass-exploited; exploitation is technically feasible but not currently observed or automated. The absence of a CISA KEV listing and no identified proof-of-concept further reduce operational urgency. The realistic threat model is a targeted attacker capable of luring a specific victim to a crafted page to infer sensitive cross-origin data - a meaningful privacy risk but not a system-compromise or data-exfiltration-at-scale scenario. The ubiquity of Chrome means the exposed surface is enormous, but the low EPSS and UI:R requirement meaningfully constrain actual exploitation at scale.

An attacker hosts a specially crafted HTML page that triggers Chrome's NoStatePrefetch to load a targeted cross-origin resource, then observes timing or cache side-channel signals - such as differences in load latency or resource cache state - to infer information about that resource's content or existence. The victim must be lured to the attacker's page via phishing, malicious advertisement, or a compromised site. No public proof-of-concept exploit has been identified at time of analysis, and the inference would likely require multiple requests and statistical analysis to yield reliable cross-origin signals.