Google Chrome CVE-2026-17785

The only prerequisite is that the victim visits an attacker-controlled HTML page using an unpatched Chrome version (prior to 151.0.7922.72) - no authentication, no special server-side configuration, and no elevated privileges are required on either side, consistent with CVSS AV:N/AC:L/PR:N. Exploitation is bounded by two concrete limiting factors: first, user interaction is mandatory (UI:R) - the victim must actively navigate to the malicious page; second, the confidentiality impact is low (C:L), meaning only fragments of uninitialized graphics memory are accessible, not arbitrary memory or full cross-origin document content, and the data exposed depends on what cross-origin content happened to occupy reused graphics buffers in the victim's current session.

CVSS 3.1 rates this Medium at 4.3, driven by a network attack vector with no complexity or privilege requirements but mandatory user interaction and limited confidentiality impact only (C:L/I:N/A:N/S:U). EPSS at 0.23% (14th percentile) is low, consistent with the absence of any KEV listing or known public POC - suggesting opportunistic mass exploitation is unlikely in the near term. The real-world priority is moderate: the attack is straightforward to set up (any hosted HTML page suffices) but requires the victim to actively visit that page and is constrained to leaking fragments of uninitialized graphics memory rather than enabling arbitrary reads or code execution. The vulnerability is most relevant to environments where users browse untrusted sites and Chrome auto-update is disabled or delayed. No data conflicts are present in the available signals.

An attacker hosts a malicious HTML page containing crafted WebGL shader or canvas operations designed to trigger the uninitialized memory read in Chrome's ANGLE layer. When a victim on a vulnerable Chrome version visits the page, the attacker's JavaScript reads back uninitialized graphics buffer data that may contain pixel or buffer fragments from cross-origin content previously rendered in the same browser session, enabling exfiltration of partial cross-origin data. No public proof-of-concept code has been identified at time of analysis.