Google Chrome CVE-2026-17897

Exploitation requires that the victim actively visits an attacker-controlled or attacker-influenced HTML page using an unpatched Chrome browser (below 151.0.7922.72). The CVSS vector (UI:R) confirms that user interaction - navigating to the crafted page - is mandatory; passive network presence is insufficient. The attacker requires no authentication to the victim's browser or any other system (PR:N). The leak is limited to data accessible via cross-origin network requests from the victim's browser context, meaning the most sensitive targets are resources the victim's browser is already authenticated to (e.g., intranet pages, session-authenticated APIs). A specific non-default configuration is not required - any user running the affected Chrome version who visits the page is potentially vulnerable. Limiting factors: the victim must follow an attacker-supplied link or visit a compromised page; the impact is read-only (no integrity or availability effect); and exploitation is not automatable at scale per SSVC assessment.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity attack that requires no privileges (PR:N) but does require user interaction (UI:R) and yields only partial confidentiality impact (C:L) with no integrity or availability impact. Real-world risk signals align closely: EPSS is 0.18% at the 8th percentile, indicating that exploitation in the wild is extremely unlikely compared to the broader CVE population. CISA SSVC classifies exploitation as 'none' and automatable as 'no', corroborating that this is not a spray-and-pray attack vector. Technical impact is rated 'partial', consistent with the limited confidentiality leak. Taken together, this is a genuine but low-urgency information-disclosure issue - the raw CVSS score does not misrepresent risk here, though the absence of integrity or availability impact keeps this below critical triage thresholds. No conflicting signals were identified across sources.

An attacker hosts a crafted HTML page designed to trigger the ORB bypass and sends the link to a target via phishing or embeds it in a compromised advertisement. When the victim loads the page in an unpatched Chrome browser, the malicious JavaScript exploits the ORB flaw to read a cross-origin response - such as a session-authenticated API response or internal resource - and exfiltrates the data to the attacker's server. No public proof-of-concept code has been identified at time of analysis, so exploitation currently requires the attacker to independently discover the precise technique.