Google Chrome CVE-2026-17937

Exploitation requires the victim to actively visit a crafted HTML page using Google Chrome prior to version 151.0.7922.72 - user interaction is mandatory (UI:R per CVSS). No attacker-side authentication or privileges are required (PR:N). The vulnerable component is DevTools, meaning the crafted page must trigger DevTools-related input processing; standard Chrome installations include DevTools by default, so no non-default configuration is required to be vulnerable. Exploitation is not automatable per SSVC assessment, ruling out mass scanning or worm-style propagation. The primary limiting factor is the required user interaction - social engineering or drive-by delivery via a compromised/malicious site is necessary. Impact is bounded to navigation restriction bypass (I:L) with no confidentiality or availability impact, further reducing the attacker's achievable objective.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields a base score of 4.3, reflecting a network-exploitable flaw requiring no attacker-side authentication but mandating user interaction (victim must visit a crafted page). Impact is confined to limited integrity degradation with no confidentiality or availability consequence, constraining the practical damage. EPSS at 0.18% (8th percentile) is well below typical exploitation thresholds, and SSVC signals confirm exploitation as 'none,' the attack as non-automatable, and technical impact as only 'partial.' The Chromium security team itself classified this as Low severity. Taken together, these signals consistently point to a low-priority issue: the attack surface is real (network-reachable, no auth required) but the exploitation barrier (mandatory user interaction, single-component impact) and absence of any public exploit or KEV listing make this a patch-cycle rather than emergency-response item.

An attacker crafts an HTML page containing content specifically designed to trigger the input validation flaw in Chrome's DevTools component, then distributes the link via phishing email or malicious advertisement. When a victim running a pre-151.0.7922.72 Chrome version visits the page, the crafted input causes DevTools to process navigation in a way that bypasses restriction checks, potentially redirecting the user to attacker-controlled content or circumventing same-origin navigation guards. No public proof-of-concept code exists at time of analysis.