Google Chrome CVE-2026-17783

Exploitation requires the victim to actively visit a crafted HTML page in a vulnerable version of Google Chrome (prior to 151.0.7922.72) - mandatory user interaction is confirmed by CVSS UI:R. The attack is network-accessible and requires no authentication or special privileges from the attacker side (PR:N). For the cross-origin data leak to yield meaningful information, the victim must have an accessible cross-origin resource (e.g., an authenticated session) at a target origin during the attack window. There are no special server-side configuration requirements on the target origin. Exploitation is limited by: (1) the attacker must successfully lure the victim to the malicious page (social engineering or malvertising step required), (2) the leaked data is partial (C:L - not full credential or session takeover), and (3) the non-default scenario of the victim being simultaneously authenticated to a sensitive target origin.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N yields a base score of 4.3 (Medium). The network attack vector with no authentication or privilege requirement lowers the barrier for an attacker to set up the exploit, but the mandatory user interaction (UI:R) and limited confidentiality impact (C:L) substantially reduce urgency. EPSS of 0.17% at the 7th percentile strongly corroborates low real-world exploitation probability at this time. There is no CISA KEV listing and no POC reported, making opportunistic mass exploitation unlikely. The realistic risk is concentrated in targeted scenarios - an attacker who knows a victim uses a specific web application and can lure them to a malicious page could exfiltrate partial cross-origin data such as tokens or page fragments. For organizations with auto-update Chrome fleets, this is a low-urgency patch; for environments where Chrome updates are managed and delayed, it warrants prioritization within a normal patching cycle.

An attacker registers a domain and hosts a crafted HTML page that exploits Chrome's Loader origin-validation flaw to read a response or resource fragment from a target origin (for example, an authenticated API response or session-bearing page the victim has open). The attacker distributes the malicious URL via phishing or a compromised ad network, inducing the victim to visit the page in their vulnerable Chrome browser. No public POC has been identified, making opportunistic exploitation unlikely at this time, but the attack is feasible for a motivated threat actor targeting a specific victim with knowledge of their web application usage.