Google Chrome CVE-2026-17933

Exploitation requires the victim to actively visit a crafted HTML page in an unpatched Chrome browser (UI:R per CVSS), making phishing or social engineering the primary delivery mechanism. The vulnerability exists in Chrome's DOMStorage component without any non-default configuration requirement - all standard Chrome deployments prior to 151.0.7922.72 are susceptible. No server-side configuration is needed. Limiting factors: the attack cannot be automated at scale (SSVC: not automatable), impact is bounded to cross-origin confidentiality disclosure (no code execution, no integrity or availability impact), and the victim must be directed to and must load the attacker-controlled page. CVSS PR:N confirms no authentication to any service is required from the attacker's side.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack that nonetheless requires mandatory user interaction (UI:R) and yields only limited confidentiality impact (C:L) with no scope change (S:U), integrity, or availability consequences. EPSS at 0.17% (7th percentile) signals minimal observed exploitation pressure across the threat landscape. SSVC corroborates this: exploitation status is none, the attack is not automatable, and technical impact is only partial. No KEV listing and no public exploit code further reduce urgency. This is a genuine but low-priority finding - real-world risk is constrained by the user-interaction requirement and the bounded impact of cross-origin storage disclosure rather than code execution.

An attacker crafts a malicious HTML page containing JavaScript that exploits the DOMStorage origin validation flaw, then delivers the link via phishing, malicious advertising, or a compromised website. When the victim visits the page in an unpatched version of Chrome, the script reads localStorage or sessionStorage data scoped to a different origin - potentially harvesting session identifiers, cached user data, or application state stored by a target web service. No public exploit code is known at time of analysis.