Google Chrome CVE-2026-17787

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 and to visit an attacker-controlled HTML page (user interaction is mandatory per UI:R in the CVSS vector). The CVSS PR:N metric confirms no authentication to any service is required from the attacker's side. The scope is unchanged (S:U), confining impact to the browser's own context. The description implicates the DevTools component specifically; however, available public data does not clarify whether DevTools must be actively open in the browser for exploitation to succeed - this is an important unconfirmed condition that defenders should verify via the Chromium issue tracker (https://issues.chromium.org/issues/513783632) once access is available. Exploitation is limited by: mandatory victim user interaction (visiting a crafted page), the integrity-only impact (no cross-origin data reads confirmed), and the unchanged scope preventing direct system-level compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 6.5 and presents a network-reachable, low-complexity attack requiring no privileges but mandating user interaction. The integrity-only impact profile limits blast radius compared to a full confidentiality-plus-integrity SOP bypass. EPSS at 0.22% (13th percentile) is notably low, suggesting the security community assesses exploitation as unlikely in the near term - this may reflect the user-interaction requirement raising the exploitation bar. There is no CISA KEV listing and no public exploit code identified at time of analysis, consistent with Chromium's own 'Medium' rating. The low EPSS despite a network-exploitable, no-privileges vector likely reflects the UI:R constraint. Real-world risk is moderate: the product is ubiquitously deployed and the attack complexity is low, but successful exploitation depends on convincing a target to visit an attacker-controlled page. Organizations should treat this as a routine monthly patch priority rather than an emergency response, unless their threat model includes targeted phishing scenarios.

An attacker crafts a malicious HTML page exploiting the DevTools origin validation flaw and hosts it on an attacker-controlled domain, then delivers the URL to a target via phishing email or malicious advertisement. When the victim opens the link in an unpatched Chrome browser, the page exploits the SOP bypass to perform unauthorized write operations into cross-origin browser contexts accessible to the victim, potentially modifying form data, injecting content, or tampering with authenticated sessions on other open tabs. No public exploit code is identified at time of analysis.