Google Chrome CVE-2026-17806

Exploitation requires two distinct prerequisites: first, the attacker must have already achieved code execution within the Chrome renderer process via a separate, unrelated vulnerability (a full renderer compromise is mandatory, not optional); second, the victim user must be induced to navigate to a crafted HTML page (UI:R) while the renderer is already compromised. The Extensions component vulnerability alone does not grant initial access. Exploitation is further limited by AC:H complexity, meaning reliable chaining of the renderer compromise and this flaw demands substantial attacker sophistication and precise timing. Non-default extension configurations are not required - the flaw exists in the Extensions input validation layer regardless of which extensions are installed.

The CVSS base score of 5.8 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L reflects the real-world constraints well. AC:H is critical here: exploitation is not standalone - the attacker must first possess a separate renderer-process compromise vulnerability to chain with this flaw, making this a second-stage exploit component rather than an initial access primitive. UI:R further requires the victim to navigate to a crafted page. The Scope:Changed flag confirms the sandbox boundary is crossed, which is the most serious aspect. Against these severity signals, EPSS at 0.17% (7th percentile) aligns with the high complexity: reliably chaining two Chrome vulnerabilities demands significant attacker capability. This CVE is not in CISA KEV and no public exploit code has been identified, consistent with the low EPSS. Net assessment: this is a meaningful vulnerability in a ubiquitous product that demands patching, but it is not an immediate emergency for defenders who have other controls in place - its real-world exploitability is constrained by the prior renderer compromise requirement.

An attacker first exploits a separate Chrome renderer vulnerability to achieve code execution within the sandboxed renderer process, then serves the victim a specially crafted HTML page containing malicious extension-related content that triggers the input validation flaw in Chrome's Extensions component, causing the browser to process attacker-controlled data across the sandbox boundary and achieving code execution at the browser-process privilege level outside the renderer sandbox. No public exploit code for this specific CVE has been identified at time of analysis.