Google Chrome CVE-2026-17799

Exploitation requires that a user actively interact with a malicious file - for example, by downloading and opening it via Chrome - satisfying the UI:R requirement in the CVSS vector; silent, background exploitation without this step is not possible. The vulnerability resides in Safe Browsing, which is enabled by default in all Chrome desktop installations, so no non-default configuration is required for the vulnerable code path to be present. Exploitation is further constrained by the non-automatable SSVC classification, meaning attackers cannot script mass exploitation without per-victim interaction. Impact is bounded to partial confidentiality and integrity loss within the browser's security context (C:L/I:L/A:N); privilege escalation to the operating system or full data exfiltration is not described in available data. Chrome instances already updated to 151.0.7922.72 or later are not affected.

The NVD CVSS base score of 5.4 (Medium) is consistent with an independent assessment: network-reachable but requiring active user interaction, with only partial C and I impact and no availability consequence. The EPSS score of 0.20% at the 11th percentile is notably low, indicating that exploitation in the wild is not currently observed at scale. SSVC reinforces this: exploitation is rated 'none,' and the automatable flag is 'no,' consistent with the UI:R constraint that prevents silent, mass-exploitation campaigns. Technical impact is 'partial,' matching C:L/I:L. Taken together, these signals indicate this is a real but low-urgency vulnerability - the DAC bypass is meaningful but bounded in scope, and no threat actor is currently weaponizing it at detectable rates. This is not a case of CVSS overrating risk; the score and real-world signals are coherent.

An attacker crafts a malicious file - such as a specially structured download - and delivers it to a target user via a phishing email, a compromised website, or social engineering that prompts the user to save and open the file through Chrome. When Chrome's Safe Browsing component processes the file, the insufficient input validation allows the malicious content to subvert the access control check, potentially granting the attacker influence over a resource or action that should be protected. No public proof-of-concept code has been identified at the time of analysis, and exploitation is not confirmed as automated or scalable.