Google Chrome CVE-2026-17919

Exploitation requires physical access to the target device (CVSS AV:P), confirmed by the description. The target must be running Google Chrome in an Enterprise managed configuration on macOS - standard consumer Chrome installations or non-Mac platforms are not in scope. The policy enforcement flaw is specific to the Enterprise management feature set on Mac; environments without managed Chrome Enterprise policies deployed are unlikely to be affected. Limiting factors include: physical presence requirement eliminates remote exploitation entirely, macOS platform specificity excludes Windows and Linux Chrome Enterprise deployments, and the Enterprise deployment mode requirement excludes unmanaged consumer Chrome instances. Authentication requirements: CVSS PR:N indicates no pre-existing system account privileges are required - physical access is the sole prerequisite.

The CVSS 3.1 vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 6.8, but the physical attack vector (AV:P) is the dominant risk-limiting factor - exploitation requires an attacker to be physically present at the target device. This is consistent with Chromium's own classification of 'Low' security severity despite the high C/I/A ratings, which reflect worst-case post-exploitation impact rather than ease of access. No EPSS data was provided in the intelligence feed; the absence of KEV listing and no public POC indicate this has not been observed in widespread exploitation. Real-world risk is therefore constrained to insider threat scenarios, device theft, or targeted physical access attacks in high-value environments (e.g., kiosks, unattended managed Macs). Organizations with strong physical security controls face minimal incremental risk. EPSS and KEV data are absent from the provided intelligence - exploitation probability cannot be quantified from available data.

An attacker with physical access to an unattended or unlocked Mac running a Chrome Enterprise managed session exploits the insufficient policy enforcement flaw to circumvent applied enterprise restrictions and escalate local privileges. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) and absence of required prior privileges (PR:N) suggest that once physical access is achieved, exploitation does not require advanced technical skill.