Google Chrome CVE-2026-17908

Two conditions must both be satisfied: first, the attacker must have already compromised the Chrome renderer process through a separate, independent vulnerability - this is a chained exploit, not a standalone attack. Second, the victim must interact with a crafted HTML page, satisfying the UI:R requirement in the CVSS vector. The vulnerability is further limited to Chrome running on Windows; non-Windows platforms are not in scope. Exploitation is not automatable per CISA SSVC assessment, meaning mass or worm-style propagation is not feasible. No special Chrome configuration or non-default feature needs to be enabled; the Printing component is present in all standard Chrome for Windows installations, but the renderer-compromise prerequisite is the dominant limiting factor for realistic exploitation.

The CVSS 3.1 score of 5.8 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L is broadly consistent with the described attack conditions: AC:H correctly reflects the substantial prerequisite of first compromising the renderer process, UI:R captures the required victim interaction, and S:C reflects the sandbox escape crossing a security boundary. However, the C:L/I:L/A:L impact metrics temper the overall score. Real-world risk signals are uniformly low: EPSS at 0.17% places this at the 7th percentile with near-negligible observed or predicted exploitation; SSVC rates exploitation as none and the attack as non-automatable; and the vulnerability is absent from CISA KEV. Chromium's own severity rating of Low is notable given that sandbox escapes are ordinarily considered high-severity - this reflects the practical difficulty of the chained attack (renderer compromise first, then printing component abuse). No conflicting signals are present; all data sources agree this is low urgency outside of environments already under active targeted attack.

An attacker first leverages a separate browser vulnerability to compromise the Chrome renderer process - for example, a memory-corruption bug in a JavaScript engine or media parser - while the victim visits a crafted HTML page. The compromised renderer then sends maliciously formed data to Chrome's Printing component on Windows, exploiting the insufficient input validation to cross the sandbox boundary. No public exploit for this specific chain is known at time of analysis, and the high attack complexity makes opportunistic mass exploitation impractical.