Google Chrome CVE-2026-17772

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 with WebGL enabled - WebGL is enabled by default in all standard Chrome installations, so no non-default configuration is required. The attacker must cause the victim to navigate to a crafted HTML page (UI:R per CVSS vector); drive-by exploitation via malicious ad networks or phishing is the realistic delivery mechanism. The CVSS PR:N metric confirms no attacker-side authentication is required. Limiting factors: the UI:R requirement prevents fully automated mass exploitation (SSVC Automatable: no); impact is restricted to a partial memory read (C:L only) with no integrity or availability consequence, meaning the attacker cannot achieve code execution from this vulnerability alone. Exploitation is bounded to the Chrome browser process memory space.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) captures a network-reachable flaw requiring no authentication but mandatory user interaction (victim must navigate to the malicious page), with impact restricted to partial confidentiality. EPSS at 0.21% (11th percentile) reflects very low near-term exploitation probability. SSVC signals - Exploitation: none, Automatable: no, Technical Impact: partial - reinforce low urgency. No CISA KEV listing and no reported POC further reduce operational risk. The absence of an integrity or availability dimension means this vulnerability cannot be directly chained to code execution without an additional primitive. Overall, real-world risk is materially lower than the network-accessible vector might suggest; this is a genuine patch-cycle priority for browser fleet management, not an emergency response item.

An attacker crafts an HTML page embedding malicious WebGL shader or buffer data designed to trigger the out-of-bounds read in Chrome's graphics pipeline, then distributes the URL via phishing email or a malicious advertisement network. A victim running Chrome prior to 151.0.7922.72 visits the page, causing the browser to read memory beyond intended bounds and potentially leaking partial browser process memory contents to the attacker. No public exploit code has been identified at time of analysis, reducing the practical likelihood of this scenario.