Google Chrome CVE-2026-17771

Exploitation requires that a victim user visit a crafted HTML page controlled by the attacker, confirmed by the CVSS UI:R metric. No authentication, account, or special browser configuration is required - the vulnerability is present in default Chrome installations on all platforms below 151.0.7922.72. Exploitation is limited by: (1) mandatory user interaction to navigate to the malicious page; (2) the low-reliability nature of uninitialized memory reads, which may not consistently yield meaningful cross-origin data; (3) Chrome's site isolation may partition renderer memory such that interesting cross-origin data is not co-located in the same process, depending on platform and configuration. The scope is limited to confidentiality (C:L) with no integrity or availability impact.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity, no-privilege-required flaw that requires user interaction and yields only partial confidentiality impact (C:L, I:N, A:N). EPSS corroborates low near-term exploitation likelihood at 0.23% (14th percentile), and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. Together these signals characterize this as a real but low-urgency finding: the cross-origin data leakage primitive is serious in theory (same-origin policy bypass), but practical exploitation requires social engineering a user to a crafted page and successfully reading meaningful cross-origin data from uninitialized memory - a non-trivial exploitation chain. The CVSS vector is internally consistent with the description: AV:N and UI:R correctly model the browser delivery mechanism, while S:U correctly reflects no scope change beyond the renderer. Priority for patching should be driven by Chrome's standard update cadence rather than emergency response.

An attacker hosts a malicious web page containing specially crafted HTML and JavaScript designed to trigger Skia's uninitialized memory path during rendering. When a victim is lured to visit the page - via phishing, malvertising, or a compromised link - the browser reads uninitialized memory in the Skia rendering pipeline, and the attacker's page-side script reads back stale data that may contain fragments of cross-origin content previously rendered in the same process. No public proof-of-concept code has been identified at time of analysis.