Google Chrome CVE-2026-17900

Exploitation requires the victim to be running Google Chrome on Windows with Enterprise policy features active, as the vulnerability is explicitly scoped to Chrome's Enterprise implementation on that platform. The user must actively interact with a malicious file - opening it in Chrome - making user interaction (UI:R) a hard prerequisite that cannot be bypassed remotely. Exploitation is further limited to Windows-only deployments; Chrome on other operating systems is not affected. The impact is constrained to partial confidentiality loss (cross-origin data leakage) with no integrity or availability dimension. Limiting factors include: mandatory user engagement with attacker-supplied content, Windows-only scope, Enterprise feature dependency, and the absence of any privilege escalation path.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects network-reachable exploitation with no privilege prerequisite, but user interaction is mandatory and the impact ceiling is limited confidentiality loss. The EPSS of 0.16% at the 6th percentile strongly suggests exploitation is unlikely in the near term. SSVC reinforces this: Exploitation rated 'none', Automatable rated 'no' - each attack requires individual user engagement with a malicious file, ruling out mass automated campaigns. The Microsoft tag in the intelligence data likely reflects the Windows-only scope of the flaw rather than any Microsoft-product involvement. Chromium's internal severity classification of 'Low' aligns with all external signals. Taken together, these signals indicate a real but low-priority issue: informational leakage only, no integrity or availability impact, no active exploitation, no public proof-of-concept, and a narrow deployment condition (Enterprise Chrome on Windows). This is a standard patch-cycle item, not an emergency.

An attacker delivers a malicious file - for example, a crafted HTML document or data file - to a targeted user via phishing email or a compromised website. When the user opens the file in Google Chrome on Windows, the Enterprise implementation's origin validation flaw allows the file's context to read data from a cross-origin source, which is then exfiltrated to the attacker. No public exploit code has been identified, and the mandatory user interaction step limits attack scalability.