Google Chrome CVE-2026-17781

Exploitation requires the target user to actively install a specifically crafted malicious Chrome Extension on an unpatched Chrome version prior to 151.0.7922.72 - the CVSS UI:R metric confirms that this user-driven installation step is mandatory and non-negotiable for exploitation. The extension must be crafted to abuse the specific cross-origin access control flaw; installing arbitrary extensions does not trigger the vulnerability. Exploitation is further constrained by: Chrome's extension installation permission dialogs which warn users about extension permissions, the Chrome Web Store's review process (circumventable via sideloading or compromised listings), and the scoped confidentiality-only impact (C:L, I:N, A:N) limiting damage to partial data exposure within the browser context. There is no drive-by, zero-click, or network-adjacent exploitation path - the social engineering prerequisite is the primary gating factor for real-world risk.

The CVSS 4.3 Medium score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately capture the constrained nature of this vulnerability: while it is network-reachable and low-complexity, it requires active user interaction (UI:R) - specifically the installation of a malicious extension - and results in only limited confidentiality impact (C:L) with no integrity or availability exposure. EPSS of 0.13% at the 3rd percentile strongly aligns with the practical barrier posed by the social engineering prerequisite, indicating this is not being exploited in mass campaigns. The absence of a CISA KEV entry and lack of any public exploit code further support treating this as a routine patch cadence item rather than an emergency response priority. The 'Authentication Bypass' tag in the source intelligence appears inconsistent with the described cross-origin data leakage mechanism; this may reflect imprecise tagging rather than a distinct bypass capability, and no conflicting CVSS signals emerge from the vector itself. Overall, real-world risk is low for organizations with managed extension policies; consumer Chrome users relying on unreviewed extension installs face marginally higher exposure.

An attacker publishes or distributes a crafted Chrome Extension - disguised as a productivity tool, ad blocker, or utility - and convinces a target user to install it via phishing, a deceptive Web Store listing, or direct sideloading. Once installed on an unpatched Chrome version, the extension exploits the improper access control flaw to silently read data from cross-origin pages the user subsequently visits, such as session identifiers or form content from authenticated web applications. No public proof-of-concept has been identified, but the low attack complexity (AC:L) in the CVSS vector suggests the exploit logic requires minimal technical sophistication once the extension installation hurdle is cleared.