Google Chrome CVE-2026-17923

Exploitation requires the target to be running Google Chrome in an Enterprise-managed deployment with navigation restriction policies actively configured and enforced - standard consumer Chrome installations with no managed policies are not affected. The CVSS UI:R metric confirms that the user must actively perform a navigation action (such as clicking an attacker-supplied link), meaning drive-by or passive exploitation is not possible. SSVC rates the attack as not automatable, further limiting mass exploitation scenarios. The crafted domain name must specifically trigger the policy engine's parsing flaw, which may require knowledge of the organization's blocked domain list to be operationally meaningful. Limiting factors: enterprise-only scope, required user interaction, and the need to bypass domain-based policy matching rather than authenticate or exploit a memory safety flaw.

The CVSS 3.1 score of 6.5 (Medium) reflects a network-origin, low-complexity attack requiring no attacker privileges but requiring user interaction (AV:N/AC:L/PR:N/UI:R), with high integrity impact and no confidentiality or availability consequences. EPSS at 0.17% (7th percentile) indicates a very low near-term exploitation probability, consistent with SSVC's ratings of exploitation: none, automatable: no, and technical impact: partial. The Chromium team itself rated severity as Low, signaling that even internally the issue is considered constrained. No KEV listing confirms no active exploitation at time of analysis. The combination of enterprise-only scope (only organizations using Chrome managed navigation policies are materially affected), required user interaction, the low EPSS, and SSVC's 'none' exploitation rating collectively suggest this is a low-urgency real-world risk despite the CVSS medium score. Organizations relying on Chrome Enterprise navigation policies as a primary access control should prioritize patching, but those using layered network controls face minimal incremental exposure.

An attacker targeting an organization that uses Chrome Enterprise to block access to sensitive external domains (e.g., data exfiltration services, unauthorized cloud storage, or competitor sites) crafts a domain name exploiting the policy parser's normalization flaw - such as a visually identical IDN variant or an unusually encoded hostname - and delivers it as a hyperlink via phishing email or compromised intranet content. When a managed-browser user clicks the link, Chrome's policy engine fails to match the crafted domain against the blocked list and completes the navigation, bypassing the enterprise control without any alert or log entry in the policy enforcement layer.