Google Chrome CVE-2026-17909

Exploitation requires: (1) the victim is running Google Chrome prior to 151.0.7922.72; (2) the victim is actively using or has loaded an Isolated Web App - a feature primarily used in enterprise and developer contexts, not enabled by default for general end-users; (3) the victim performs some user interaction (UI:R per CVSS) that causes the browser to process the attacker-controlled network traffic. Limiting factors: the IWA feature requirement narrows the exposed population significantly compared to a general Chrome browser flaw; user interaction cannot be bypassed; impact is strictly read-only cross-origin data leakage with no code execution, privilege escalation, or availability impact. Authentication is not required from the attacker's perspective (PR:N per CVSS), but the victim must be in an active IWA session.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (UI:R), which materially limits opportunistic mass exploitation. The scope is unchanged (S:U), meaning exploitation does not break out of the Chrome process sandbox, and the only impact is limited confidentiality (C:L). EPSS at 0.16% (6th percentile) strongly corroborates a low probability of observed exploitation, aligning with the absence of a CISA KEV listing. Chromium's internal severity rating of 'Low' is consistent with these signals. This is not a high-priority emergency: the vulnerability represents a real but bounded information disclosure risk, primarily relevant to environments actively deploying Isolated Web Apps. The combination of UI:R, C:L-only impact, and very low EPSS argues against escalated remediation priority outside IWA-heavy enterprise deployments.

An attacker hosts or intercepts malicious network traffic targeting a victim who is actively using a Chrome Isolated Web App prior to version 151.0.7922.72. When the victim's browser processes this traffic - requiring some form of user interaction such as navigation or in-app network activity - the insufficient input validation allows the attacker's content to read data from a different origin that the IWA isolation model should protect. No public proof-of-concept exploit code is known at time of analysis, limiting realistic exploitation to sophisticated actors with knowledge of the internal IWA validation flaw.