Google Chrome CVE-2026-17911

Exploitation requires a victim user to actively visit an attacker-controlled or attacker-influenced web page containing a crafted SVG payload - user interaction (UI:R in the CVSS vector) is a mandatory prerequisite and is confirmed by SSVC's Automatable: no finding. The victim must be running Google Chrome versions prior to 151.0.7922.72. No special server-side configuration is required; the vulnerability exists in the client-side browser rendering engine. Exploitation is further limited to confidentiality impact only (C:L) - an attacker can read cross-origin data but cannot modify it or cause availability loss. The scope is contained to the victim's browser session (S:U), meaning server-side systems are not directly compromised. Exploitation is not constrained by any non-default Chrome configuration requirement - any default Chrome installation on an affected version is susceptible when a user visits a malicious page.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects a network-accessible, low-complexity attack with no authentication requirement but a hard dependency on user interaction, resulting in limited confidentiality impact only. EPSS at 0.17% (7th percentile) is very low, consistent with SSVC's Automatable: no finding - the UI:R constraint prevents fully automated exploitation. SSVC Technical Impact of partial aligns with C:L and the absence of integrity or availability impact. KEV status is not confirmed, and no POC exists in the provided data. The convergence of these signals - low EPSS, no KEV, no automatable path, partial technical impact - indicates this is a genuine but genuinely low-priority vulnerability that does not warrant emergency response. The ubiquitous prevalence of Chrome means absolute exposure counts are high even at low per-instance risk, so organizations with sensitive authenticated web applications accessible to Chrome users should still prioritize patching in their next standard cycle.

An attacker crafts an HTML page embedding a malicious SVG that exploits the origin-enforcement gap - for example, an SVG filter or use-element reference that reads pixels or DOM data from an authenticated cross-origin response - and distributes it via phishing email or a compromised third-party advertisement. When a victim using Chrome prior to 151.0.7922.72 visits the page, the browser's SVG engine violates the Same-Origin Policy and returns cross-origin data to the attacker's script, potentially exposing session-authenticated content such as internal application responses. No public exploit code has been identified at time of analysis.