Google Chrome CVE-2026-17929

The attack requires that the target user actively open or interact with a malicious file delivered by the attacker - this is the critical limiting factor encoded as UI:R in the CVSS vector. The vulnerability resides in the DevTools component, implying the malicious file must trigger DevTools-related input processing within Chrome. No authentication or privilege on the victim system is required from the attacker (PR:N). The scope is unchanged (S:U), meaning exploitation does not escape the Chrome browser sandbox into the operating system. Exploitation is further bounded by the integrity-only impact: an attacker gains navigation restriction bypass but cannot exfiltrate data (C:N) or crash the application (A:N). Non-default conditions such as DevTools being explicitly disabled via enterprise policy would prevent exploitation on managed devices.

The CVSS 3.1 base score of 6.5 (Medium) is driven primarily by the high integrity impact (I:H) and network attack vector (AV:N), but partially deflated by the required user interaction (UI:R) and no scope change (S:U). Real-world risk signals reinforce the lower-priority classification: EPSS at 0.17% in the 7th percentile indicates extremely low observed or modeled exploitation probability relative to the broader vulnerability population, and no CISA KEV listing confirms no confirmed active exploitation at time of analysis. No public POC has been identified in the provided data. The UI:R requirement meaningfully reduces the attack surface to scenarios where a user is socially engineered into opening a malicious file. The absence of confidentiality (C:N) and availability (A:N) impact further bounds the damage potential. Overall, this is a legitimate integrity concern worth patching promptly via Chrome's standard update cycle, but it does not represent an emergency escalation priority absent KEV confirmation or POC emergence.

An attacker crafts a malicious file - such as a specially structured HTML, JavaScript, or data file - designed to trigger the flawed input-validation path in Chrome's DevTools when processed. The file is delivered to a target via phishing email, a drive-by download, or a malicious web page, and the user opens it in an unpatched Chrome instance. Once processed, the attacker's input bypasses Chrome's navigation restrictions, potentially allowing unauthorized redirection of the user's browsing session or injection into a protected navigation context. No public POC has been identified at time of analysis.