Google Chrome CVE-2026-17790

The victim must be running Google Chrome on Windows (the vulnerability is Windows-specific per the description and is not reported on macOS or Linux). The victim must actively navigate to or be redirected to an attacker-controlled or attacker-compromised HTML page - the UI:R metric in the CVSS vector confirms user interaction is required. No authentication, login, or special browser configuration is needed on the attacker's side (PR:N). Exploitation is limited to leaking data within the Chrome renderer process; Chrome's sandbox prevents direct OS-level access. The vulnerability does not apply to Chrome on non-Windows platforms based on the available description. The limiting factors are: Windows-only scope, required user page visit, renderer-sandbox containment of any leaked data, and no confirmed integrity or availability impact.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) captures a remotely triggerable information-disclosure bug requiring a single user interaction - navigating to an attacker-controlled page - with no privilege requirement. The EPSS score of 0.23% at the 14th percentile reflects very low real-world exploitation probability, consistent with the medium severity rating and absence of CISA KEV listing or known POC. The scope is limited to Windows (the description explicitly scopes it there) and to the Chrome renderer process, which further caps blast radius. The primary real-world risk is that uninitialized heap or stack data from the renderer could be exfiltrated; because the renderer is sandboxed, the attacker cannot directly pivot to the host OS from this vulnerability alone. This is a genuine but low-urgency finding: the broad Chrome install base gives it reach, but the impact ceiling, low EPSS, and fast Chrome auto-update cadence significantly reduce operational risk for most organizations.

An attacker registers or compromises a website and embeds a crafted HTML page containing WebGL or graphics-heavy content designed to trigger the ANGLE uninitialized-read path in Chrome's renderer process. A Windows user browsing to that page with an unpatched version of Chrome could have fragments of renderer process memory - potentially including residual content from prior page visits - transmitted back to the attacker. No public POC exists at time of analysis, but the attack surface (any web page viewable in Chrome) makes drive-by delivery straightforward if a weaponized trigger were developed.