Google Chrome CVE-2026-17795

Exploitation requires two specific prerequisites to be simultaneously satisfied: first, the attacker must have already achieved renderer process compromise in the target Chrome instance - this is an explicit prerequisite stated in the description and represents a significant barrier, typically requiring a separate renderer exploit such as a V8 or Blink memory-corruption vulnerability; second, the victim user must visit and interact with a crafted HTML page (UI:R), meaning the attack cannot be completed passively. The GetUserMedia API must be accessible from the renderer context, which it is by default in Chrome when pages request media access. What limits exploitation: the renderer compromise prerequisite alone substantially restricts the realistic attacker population to those already executing a multi-stage attack chain; the impact is further bounded to a limited confidentiality leak (C:L) with no integrity or availability consequence; and the low EPSS score (0.21%) confirms the vulnerability is not being broadly targeted.

The official CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N presents a notable discrepancy: the description explicitly requires a pre-compromised renderer process, a substantial prerequisite that is not captured by AC:L or PR:N in the base score. In practice, this vulnerability is a second-stage exploitation step, not a standalone attack - attackers must first pwn the renderer via a separate (likely more severe) vulnerability before this flaw becomes reachable. EPSS of 0.21% (11th percentile) corroborates low exploitation likelihood. This CVE is not listed in CISA KEV, and no POC has been identified. Impact is limited to confidentiality (C:L), with no integrity or availability dimension. Real-world priority is lower than the CVSS base score suggests; defenders with unpatched Chrome instances should deprioritize this relative to standalone network-exploitable, unauthenticated flaws unless they are already responding to a renderer-level compromise.

An attacker who has first compromised a Chrome renderer process - for example, by exploiting a separate renderer memory-corruption vulnerability in Chrome's JavaScript engine - then navigates the victim's browser to a crafted HTML page that invokes the GetUserMedia API in a manner that crosses origin boundaries, causing Chrome to leak data from a cross-origin context back to the attacker-controlled renderer. The victim must interact with the crafted page (satisfying UI:R), and the leaked cross-origin data (C:L) would then be accessible to the attacker via the already-compromised renderer. No public proof-of-concept exploit code is known to exist at time of analysis.