Google Chrome CVE-2026-17931

Exploitation requires a victim running Google Chrome prior to 151.0.7922.72 to visit an attacker-controlled crafted HTML page - mandatory user interaction (UI:R) is a hard prerequisite. The vulnerability is in DevTools' underlying implementation of navigation restrictions, not a user-visible DevTools panel feature; the victim does not need to have DevTools open. No authentication or privileges are required on the attacker's side (PR:N per CVSS). Exploitation is constrained by: mandatory victim-side user interaction (the victim must navigate to the attacker's page), impact limited exclusively to integrity (no data exfiltration or availability disruption), non-automatable exploitation per SSVC (meaning mass scanning or worm-style propagation is not feasible), and Chromium's own Low internal severity assessment indicating the navigation bypass has limited practical consequence within Chrome's security model.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 6.5 Medium, capturing network-accessible exploitation requiring no attacker authentication but mandating victim interaction - the user must visit the attacker's crafted page. Impact is restricted solely to Integrity (I:H); Confidentiality and Availability are unaffected. EPSS at 0.18% places this at the 8th percentile, indicating extremely low exploitation probability within 30 days relative to all CVEs in the dataset. SSVC signals further reinforce low urgency: Exploitation is none, Automatable is no, and Technical Impact is partial - meaning automated mass exploitation is not feasible and the realistic damage is bounded. Chromium's own Low internal severity rating diverges from NVD's Medium, a discrepancy that is important context for triaging teams. No KEV listing and no POC availability mean there is no confirmed or anticipated active exploitation at this time. Taken together, this vulnerability should be addressed in the normal monthly patch cycle rather than as an emergency, particularly for enterprise fleets where Chrome auto-update may already be delivering the fix.

An attacker registers a malicious domain and hosts a crafted HTML page designed to trigger the DevTools navigation restriction bypass. The attacker lures a target Chrome user to visit this page via phishing, malicious advertisement, or injected link, whereupon the page exploits the inappropriate DevTools implementation to circumvent navigation security controls. No public exploit code has been identified at time of analysis, so current exploitation would require attacker-developed tooling based on the Chromium bug report.