Google Chrome CVE-2026-17769

Exploitation requires the victim to actively visit a crafted HTML page using a Google Chrome desktop version prior to 151.0.7922.72 (UI:R - user interaction is mandatory per the CVSS vector). The Cast feature must be available and operational, which is the default desktop Chrome configuration - no special user-side configuration is required to be vulnerable. The CVSS PR:N confirms no attacker authentication is needed. Exploitation is constrained to confidentiality-only impact (C:L - limited data leakage, not arbitrary read) and requires the victim's browser to have meaningful cross-origin context to leak (e.g., an active authenticated session in another tab or iframe). The flaw does not enable code execution, privilege escalation, or persistence.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N scores 4.3 (Medium), reflecting a network-reachable flaw requiring no attacker privileges but demanding user interaction (UI:R), with only limited confidentiality impact (C:L) and no integrity or availability loss. EPSS at 0.21% (11th percentile) places this well below the threshold of actively weaponized vulnerabilities. No KEV listing and no public POC further corroborate low near-term exploitation risk. Critically, the impact is bounded to cross-origin data leakage - not code execution - limiting the blast radius considerably. The principal real-world risk is targeted information theft (e.g., leaking authenticated session content from another origin) against specific high-value users, not broad opportunistic exploitation. Overall this is a genuine but lower-priority patching item compared to RCE or privilege escalation class flaws in the same browser.

An attacker crafts a malicious HTML page that abuses the Cast component's input validation gap to trigger a cross-origin data read - for instance, extracting partial content from an authenticated session on a co-visited origin. The victim, running an unpatched Chrome desktop browser, is lured to the page via a phishing link or a malicious advertisement, and the Cast component processes the attacker-controlled input, leaking the cross-origin data back to the attacker's server. No public exploit code has been identified at time of analysis, making this scenario primarily theoretical at present.