Google Chrome CVE-2026-17764

The victim must actively navigate to or be redirected to an attacker-controlled HTML page (UI:R - user interaction is required and cannot be eliminated). The FedCM API must be available and accessible in the targeted Chrome version, which it is by default in affected builds - no special non-default configuration is needed on the victim's side. The CVSS PR:N metric confirms no authentication to any service is required on the attacker's part. Exploitation is limited by the following factors: the requirement for user interaction prevents fully automated or passive network exploitation; the integrity-only impact (C:N) means the attacker cannot directly exfiltrate sensitive data through this vector alone; and the scope is unchanged (S:U), meaning the impact is contained within the browser security context rather than escaping to the underlying OS.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-accessible, low-complexity attack requiring no privileges on the attacker's side, but mandating user interaction - the victim must navigate to an attacker-controlled HTML page. The integrity impact is rated High while confidentiality and availability are unaffected, indicating the attacker can manipulate or forge cross-origin data or actions but cannot directly read sensitive data or cause denial of service. The EPSS score of 0.22% at the 13th percentile is low, and there is no CISA KEV listing and no known public exploit, meaning real-world active exploitation is not currently confirmed. The UI:R constraint meaningfully limits opportunistic exploitation compared to purely automated attack chains. Overall, this is a genuine security concern warranting prompt patching due to SOP bypass potential in a ubiquitous browser, but the low EPSS and absence of KEV or POC suggest it is not an immediate critical-priority incident for most organizations - standard patch cadence is appropriate.

An attacker registers a malicious origin and hosts a crafted HTML page that initiates a FedCM-based identity flow with a specially constructed request designed to exploit the SOP enforcement failure. When a victim user visits or is redirected to the attacker's page (via phishing, malvertising, or a compromised site), the FedCM implementation processes the crafted flow, allowing the attacker's origin to perform integrity-impacting cross-origin actions - such as forging identity assertions or manipulating cross-origin resources - that the Same Origin Policy should have blocked. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) means that once the SOP bypass mechanism is understood, exploitation does not require sophisticated tooling.