Google Chrome CVE-2026-17928

User interaction is required: the victim must visit a crafted HTML page (UI:R in the CVSS vector). No authentication to the attacker's infrastructure is required, and no special browser configuration beyond a default installation of Chrome prior to 151.0.7922.72 is needed. Exploitation is limited to confidentiality (partial cross-origin data read only); the attacker cannot modify data or crash the browser. The cross-origin data accessible via the DataTransfer leak is limited to what the victim's browser session can reach at the time of interaction. Exploitation is constrained by the need to socially engineer a target into visiting the attacker's page.

Real-world risk is low despite the network-accessible attack vector. The CVSS 3.1 base score of 4.3 reflects AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - exploitation requires user interaction (UI:R), the confidentiality impact is limited (C:L), and there is no scope change, integrity impact, or availability impact. EPSS exploitation probability of 0.17% (7th percentile) aligns with the low real-world urgency signal. This vulnerability does not appear in the CISA KEV catalog, and no public proof-of-concept code has been identified. Chromium's own security severity rating is Low, which is consistent across all available signals. The primary risk is targeted data theft from users visiting attacker-controlled pages, not mass exploitation. Organizations should treat this as a routine patch-cycle item rather than an emergency response priority.

An attacker publishes or injects a crafted HTML page that triggers an abnormal DataTransfer interaction - such as a synthetic clipboard or drag event - to read data from a cross-origin frame or resource the victim's browser session can access. The victim visits or is redirected to this page, after which the attacker-controlled script can exfiltrate the leaked cross-origin data to an attacker server. No public proof-of-concept code has been identified, and the low-impact confidentiality-only nature of the leak limits the attractiveness of exploitation compared to higher-severity Chrome vulnerabilities.