Google Chrome CVE-2026-17765

Exploitation requires two distinct conditions: first, the attacker must have already achieved compromise of the victim's Chrome renderer process through a separate, chained vulnerability - this is a prerequisite stated explicitly in the CVE description and is not captured by the CVSS PR:N metric. Second, user interaction is required (UI:R): the victim must visit a crafted HTML page served by or accessible to the attacker. No special Chrome configuration beyond default is implied. The impact is strictly limited to cross-origin data leakage (confidentiality only); there is no integrity or availability component. The renderer compromise prerequisite is the primary limiting factor for real-world exploitation, constraining this to multi-stage attack chains rather than standalone exploitation.

The NVD CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) is partially misleading: AC:L and PR:N suggest a straightforward, unauthenticated network attack, but the description explicitly requires a prior renderer process compromise - a substantial prerequisite not encoded in the vector. This mismatch means the official vector understates real-world attack complexity. EPSS at 0.21% (11th percentile) is consistent with a chained, low-opportunism vulnerability and corroborates that mass exploitation is unlikely. There is no CISA KEV listing and no reported POC, so no confirmed active exploitation exists at time of analysis. The impact is confidentiality-only (C:L), with no integrity or availability consequence, limiting the blast radius. SSVC signals suggest low automatable risk (requires chained renderer exploit, user interaction) but non-trivial technical impact in a targeted attack scenario. Real-world priority: moderate-low for most organizations; elevated for those concerned with advanced targeted attacks that chain multiple browser vulnerabilities.

An attacker who has first achieved renderer process compromise via a separate chained vulnerability delivers a crafted HTML page to the victim's Chrome session, exploiting WebProtect's origin validation flaw to read cookies, tokens, or page content belonging to a co-loaded cross-origin domain. The victim must actively visit or be redirected to the crafted page (UI:R). No public POC has been identified, making opportunistic mass exploitation unlikely; this scenario is most realistic in targeted attacks where multiple browser vulnerabilities are chained.