Google Chrome CVE-2026-17905

Exploitation requires a victim user to actively visit an attacker-controlled HTML page using a vulnerable version of Google Chrome (any version prior to 151.0.7922.72 on desktop). The CVSS UI:R metric confirms user interaction is mandatory - passive network exposure without the victim visiting the page is not sufficient. The SSVC assessment confirms the attack is not automatable. The vulnerability is specific to the SurfaceCapture subsystem, so it is relevant in contexts where this functionality is active or reachable during page rendering. No authentication is required from the attacker's perspective (PR:N). Exploitation is limited by: requirement for victim to navigate to a crafted page (social engineering dependency), non-automatable nature per SSVC, and the narrow partial confidentiality impact (C:L), making mass or indiscriminate exploitation unlikely.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, unauthenticated, low-complexity attack requiring user interaction with only partial confidentiality impact and no integrity or availability impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). EPSS at 0.17% (7th percentile) indicates very low probability of near-term exploitation in the wild, consistent with the SSVC assessment of exploitation status 'none' and non-automatable attack. Technical impact is rated partial by SSVC. All three signals - CVSS, EPSS, and SSVC - consistently characterize this as a lower-priority disclosure vulnerability. No KEV listing and no known proof-of-concept further support a patch-at-next-cycle posture for most organizations. The primary real-world risk is targeted data exfiltration via social engineering rather than mass exploitation.

An attacker hosts a specially crafted HTML page that triggers the SurfaceCapture origin validation flaw when rendered by a vulnerable Chrome version. When a victim is socially engineered into visiting the page, the page causes Chrome to leak data from a cross-origin context - potentially sensitive content from another open tab or frame - back to the attacker-controlled origin. No public proof-of-concept exists, and exploitation requires active user interaction to visit the malicious page.