Google Chrome CVE-2026-17792

Exploitation requires a user running Google Chrome prior to version 151.0.7922.72 to actively navigate to and interact with an attacker-controlled crafted HTML page (UI:R in CVSS). No authentication, elevated privilege, or non-default Chrome configuration is required by the attacker. Exploitation is bounded by the user interaction requirement - SSVC confirms the attack is not automatable, meaning mass exploitation is not feasible. The scope is unchanged (S:U), confining impact to the browser session itself. No platform-specific or OS-level condition is documented as required beyond running an unpatched Chrome desktop build.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-delivered attack with no privileges or special configuration required, but with a mandatory user interaction step and no confidentiality or availability impact. The high integrity score (I:H) captures the spoofing potential: a user deceived by a crafted credential dialog could submit credentials to an attacker. However, real-world risk signals are uniformly low: EPSS at 0.21% (11th percentile) indicates this class of flaw is rarely exploited, SSVC classifies exploitation as 'none' and automatable as 'no', and the vulnerability is absent from CISA KEV. The SSVC 'Technical Impact: partial' designation is consistent with UI-layer spoofing that does not yield direct code execution or system compromise. One mild tension: the input tags include 'Information Disclosure', which conflicts with the CVSS C:N rating - the flaw itself does not directly exfiltrate data, though a successful spoof could indirectly result in credential disclosure. This is not a priority for emergency patching but should be addressed in standard patch cycles given Chrome's ubiquitous deployment footprint.

An attacker registers a domain and serves a crafted HTML page that exploits the Credential Management implementation flaw to render a spoofed browser credential prompt that visually mimics a login dialog for a trusted site. A victim browsing to this page in an unpatched Chrome instance sees the fraudulent credential UI and submits their username and password, which the attacker captures. No public exploit code has been identified, and the SSVC assessment confirms the attack cannot be automated at scale due to the required user interaction.