Google Chrome CVE-2026-17800

Exploitation requires that the victim user actively visit an attacker-controlled or compromised web page rendered by a vulnerable Chrome version (prior to 151.0.7922.72); this user interaction (UI:R) is a mandatory prerequisite and cannot be bypassed remotely. The CVSS vector PR:N confirms no authentication to Chrome or any service is required of the attacker. The MediaRecording feature must be accessible from the browser context, which it is by default in all standard Chrome configurations - no non-default setting needs to be enabled by the victim. Exploitation is limited by: the requirement to lure the victim (non-automatable per SSVC), the absence of known public exploit code, and the complexity of reliably reading useful memory contents from a randomized process layout. Chrome's sandbox architecture may also constrain the sensitivity of data reachable from the renderer process, though the CVSS C:H rating indicates the vendor assesses the potential confidentiality impact as significant.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5, reflecting meaningful information-disclosure potential against any user who visits a malicious page. However, secondary signals consistently moderate this: EPSS is 0.21% at the 11th percentile, placing it well below the exploitation threshold that defenders typically prioritize urgently. CISA SSVC confirms exploitation status as none, marks the attack as not automatable (an attacker must socially engineer or redirect a user to a crafted page), and rates technical impact as only partial. There is no CISA KEV listing and no POC code identified at time of analysis. The UI:R requirement is a meaningful friction factor - mass exploitation is implausible without a separate delivery mechanism. The High confidentiality impact is genuine if exploited, since process memory in Chrome can contain authentication tokens, session cookies, and plaintext from rendered content, but the low EPSS and non-automatable classification suggest that operationalizing this as a reliable exploit is non-trivial. Overall, this is a real but non-urgent patch: apply in the next normal update cycle rather than emergency-patching.

An attacker hosts a crafted HTML page that invokes Chrome's MediaRecording API through a sequence of JavaScript calls designed to trigger the inappropriate memory-lifecycle behavior in the subsystem. A victim is lured to that page - via phishing link, malicious advertisement, or compromised website redirect - and the page silently reads process memory contents, potentially capturing session cookies, authentication tokens, or other sensitive data from the browser process, which can then be exfiltrated to an attacker-controlled server. No public POC exploit code has been identified at time of analysis, and crafting a reliable exploit likely requires detailed knowledge of Chrome's memory layout.