Google Chrome CVE-2026-17907

Exploitation requires a victim to be running Google Chrome prior to version 151.0.7922.72 and to actively navigate to (or be redirected to) an attacker-controlled HTML page - mandatory user interaction (UI:R) is a hard prerequisite. No special non-default Chrome configuration or feature enablement is required; the vulnerability is present in default Chrome installations. Exploitation is concretely limited by: (1) the mandatory user interaction - drive-by without any click or navigation is not possible per the CVSS UI:R designation; (2) the limited data leakable - only partial cross-origin information (C:L), not session tokens, credentials, or arbitrary memory; and (3) Chrome's default Site Isolation, which may reduce the fidelity of side-channel observations in practice. Authentication to Chrome or any Google service is not required (PR:N).

The NVD-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) is internally consistent with the described vulnerability: network-reachable, no authentication, low complexity, but requiring user interaction and yielding only limited confidentiality impact with no scope change. EPSS at 0.17% (7th percentile) places this firmly in the low-exploitation-probability tier, consistent with the absence of any KEV listing and no referenced POC. The Chromium team's own 'Low' severity rating aligns with the limited data leakage achievable. Chrome's default Site Isolation defenses may also attenuate the observable side-channel signal in practice, potentially making real-world exploitation harder than the AC:L metric implies - however, this cannot be confirmed from available data. Overall, this is a genuine vulnerability meriting routine patching but not emergency response; organizations with elevated privacy requirements (government, healthcare, financial) should prioritize the update given the cross-origin data disclosure nature.

An attacker registers a domain and serves a crafted HTML page containing JavaScript that triggers a series of cross-origin network requests timed to exploit behavioral differences in Chrome's Network component. A targeted user running Chrome prior to 151.0.7922.72 visits the page - via phishing link, malicious advertisement, or compromised website - and the page's scripts measure timing or connection-state side effects to infer information about cross-origin resources (such as whether a resource exists, its approximate size, or response characteristics) that the Same-Origin Policy should make opaque. No public POC has been identified, making this a sophisticated, research-level attack at present.