Google Chrome CVE-2026-17797

Exploitation requires a victim running Google Chrome on any desktop platform in a version prior to 151.0.7922.72 to visit an attacker-controlled HTML page containing malicious CSS - this single user navigation action (UI:R per CVSS) is the only prerequisite. No authentication to any service is required, no special browser configuration or feature flag needs to be enabled, and no server-side access to the victim's other web applications is needed. Exploitation is constrained by the user interaction requirement - the victim must be socially engineered or redirected to the crafted page - and is not automatable per SSVC assessment. The cross-origin impact (UXSS) is further limited to origins for which the victim has an active browser session at the time of exploitation.

The CVSS 6.1 Medium score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N reflects a network-reachable flaw with no privilege or configuration prerequisite, moderated by the requirement for user interaction (UI:R). The scope change (S:C) is the most consequential metric here - it signals that successful exploitation breaches the Same-Origin Policy, allowing the attacker's injected code to operate across victim origins, which is more dangerous than the partial C:L/I:L impact ratings suggest in isolation. EPSS at 0.20% (11th percentile) indicates very low observed exploitation probability at time of analysis, and SSVC independently confirms exploitation=none and automatable=no - meaning no current evidence of active or scripted mass exploitation. Together, these signals indicate a real but not emergency-tier priority: patch within the normal update cycle rather than via emergency change management. No conflicting signals identified across available intelligence sources.

An attacker constructs a web page containing specially crafted CSS that triggers Chrome's inappropriate CSS implementation, bypassing Same-Origin Policy enforcement. The attacker lures a victim - via phishing, malicious advertisement, or compromised site redirect - to visit this page in an unpatched Chrome browser. Once loaded, the injected script executes in cross-origin contexts accessible to the browser session, allowing theft of authentication cookies, session tokens, or sensitive page content from other origins the victim has active sessions with.