Google Chrome CVE-2026-17936

Exploitation requires two explicit prerequisites: the target user must visit a crafted HTML page AND be convinced to perform specific UI gestures as directed by attacker-controlled content - both conditions are embedded in the CVSS UI:R designation. Standard Chrome installations with DevTools accessible (the default for all desktop users) are in scope per the CPE string. Exploitation is constrained by the social engineering dependency, which prevents automation or mass targeting. The Chromium team's 'Low' severity classification further indicates the bypass's practical value is limited even when fully triggered - likely requiring additional conditions or chaining with other vulnerabilities to achieve meaningful attacker goals. The CVSS PR:N confirms no authentication to any target service is required, but the UI:R requirement is the primary real-world limiting factor.

The CVSS 3.1 score of 6.5 (Medium) reflects network delivery (AV:N), no privilege requirements (PR:N), mandatory user interaction (UI:R), unchanged scope (S:U), and High integrity impact (I:H) with no confidentiality or availability impact. However, the Chromium team's own 'Low' internal severity classification is a significant counter-signal: it suggests the bypass is highly context-dependent or of limited practical value to attackers without additional primitives. EPSS at 0.18% (8th percentile) strongly corroborates low exploitation likelihood, with no CISA KEV listing and no known public POC at time of analysis. The mandatory UI:R requirement means the attack is not automatable and relies on social engineering, substantially reducing mass-exploitation potential. The discrepancy between CVSS I:H and Chromium's 'Low' label should lead defenders to treat this as a medium-priority patch rather than an emergency response item.

An attacker hosts a crafted HTML page and social-engineers a target Chrome user into visiting it and performing specific UI gestures - such as clicking or dragging elements as prompted by the page. The inappropriate DevTools implementation is then triggered, allowing the attacker to bypass Chrome's navigation restrictions and potentially redirect the browser to unauthorized destinations or manipulate navigation state in ways the browser security model is intended to prevent. No public POC is known at time of analysis, and the Chromium 'Low' classification suggests the practical impact of a successful bypass is limited without additional attack primitives.