Google Chrome CVE-2026-17934

Exploitation requires a victim to actively visit an attacker-controlled crafted HTML page using Google Chrome prior to version 151.0.7922.72; passive exposure without visiting the page is not exploitable (CVSS UI:R). No authentication to any service is required on the attacker's side (CVSS PR:N), but the attacker must successfully deliver the crafted page to the victim's browser. Impact is strictly limited to navigation restriction bypass with no confidentiality or availability effect (C:N/A:N in CVSS). The SSVC Automatable: no rating constrains mass or worm-style exploitation. No special server-side configuration or non-default Chrome settings are identified as prerequisites. Exploitation is further limited by Chromium's unchanged scope (S:U), meaning the flaw cannot be used to escape the browser sandbox or achieve code execution.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity flaw requiring user interaction with integrity-only impact and no scope change. EPSS at 0.22% (13th percentile) is very low, indicating the research and threat community views exploitation as unlikely in practice. SSVC confirms Exploitation: none, Automatable: no, and Technical Impact: partial - further corroborating that mass or automated exploitation is not a realistic near-term scenario. Chromium's own severity rating of Low is consistent with all quantitative signals. No KEV listing and no public POC exist at time of analysis. The confluence of UI:R (mandatory victim interaction), limited integrity-only impact, and Automatable: no means this is a genuine but low-priority finding. Security teams with standard Chrome update cadences are not at elevated risk. The one signal worth watching is PR:N, which removes authentication as a barrier, but the UI:R requirement and absence of any confidentiality or availability impact substantially limit practical blast radius.

An attacker hosts a crafted HTML page designed to trigger insufficient input validation in Chrome's DevTools processing layer. A victim running an unpatched version of Chrome visits the page - satisfying the mandatory user-interaction requirement - after which the attacker's script exploits the navigation bypass to redirect a frame or window to an origin that Chrome's navigation restrictions would otherwise block. No public POC exists at time of analysis, and SSVC's Automatable: no rating indicates automated mass delivery is not straightforward.