Google Chrome CVE-2026-17798

User interaction is required: the victim must actively visit an attacker-controlled or attacker-influenced HTML page in Chrome (reflected by UI:R in the CVSS vector). The Cast feature must be present and accessible, which is the default in all standard Chrome desktop installations - no non-default configuration is required to be vulnerable. No authentication or prior access to the victim's system is needed (PR:N). Exploitation is bounded to partial confidentiality loss (C:L); integrity and availability of the victim system are not impacted. Limiting factors include the social engineering step to direct a user to the malicious page, the restriction to Chrome desktop versions below 151.0.7922.72, and the limited data-disclosure scope compared to full session hijacking.

The CVSS 3.1 base score of 4.3 (Medium) is commensurate with the actual risk profile. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-accessible attack requiring no privileges but mandating user interaction - the victim must visit an attacker-controlled HTML page. The Scope is Unchanged (S:U), limiting blast radius to the victim browser session, and confidentiality impact is Low (C:L), meaning only partial data disclosure rather than full credential or session compromise. EPSS at 0.21% (11th percentile) is very low, suggesting the security community does not currently assess this as likely to be exploited at scale. There is no CISA KEV listing and no public POC reported. The combination of required user interaction, low confidentiality impact, and low EPSS places this firmly in the 'patch on regular cycle' category rather than an emergency response priority. No conflicting signals are present between the CVSS vector and the description.

An attacker crafts a malicious HTML page that abuses Chrome's Cast feature to initiate or observe cross-origin resource access, bypassing same-origin validation. When a Chrome user (running a version prior to 151.0.7922.72) visits the attacker's page - via phishing link, malicious ad, or compromised site - the page silently reads data belonging to a different origin (e.g., a logged-in session page) and exfiltrates it. No public POC exists at time of analysis, so real-world exploitation would require attacker-developed tooling.