Google Chrome CVE-2026-17914

The victim must be running Google Chrome prior to version 151.0.7922.72 and must actively navigate to or load a crafted HTML page under attacker control (UI:R - user interaction required, not passive). No authentication or special privileges are required of the attacker (PR:N), but the side-channel measurement must be executed with high precision against Skia's rendering behavior, a constraint captured by CVSS AC:H. Exploitation is further limited to the Chrome process memory space (S:U - no scope change), meaning the attacker cannot directly pivot to the OS or other processes. There is no indication that a specific Chrome feature flag, non-default configuration, or specific OS platform is required beyond a vulnerable version; however, the high attack complexity means environmental factors such as CPU architecture, cache layout, and timing resolution will influence whether a given attempt succeeds.

The 5.3 CVSS Medium score reflects a genuine tension between high confidentiality impact (C:H, sensitive process memory readable) and significant exploitation barriers (AC:H, UI:R). A successful attack requires both convincing a user to visit a crafted page and executing a precision side-channel measurement against Skia's rendering timing - the AC:H metric captures this complexity honestly. EPSS of 0.17% at the 7th percentile reinforces that exploitation is not occurring at scale; there is no CISA KEV listing and no POC identified at time of analysis. This is a classic high-C-but-low-real-risk configuration: the theoretical damage ceiling is high, but the path to exploitation is non-trivial. For most enterprise environments, this is a patch-in-next-cycle priority rather than an emergency response item. The absence of a scope change (S:U) means the attacker is confined to the Chrome process boundary, limiting blast radius.

An attacker hosts a webpage containing crafted HTML or SVG content engineered to trigger specific Skia rendering code paths that exhibit measurable timing or cache-state variations correlated with adjacent process memory. When a victim on an unpatched Chrome version visits the page, the attacker's JavaScript measures these side-channel signals - likely through high-resolution timing APIs or shared resource contention - and reconstructs fragments of sensitive process memory such as authentication tokens or cross-origin data. No public POC is known; successful exploitation requires precise calibration of the side-channel measurement, consistent with the CVSS AC:H rating.