Google Chrome CVE-2026-17939

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 and to encounter attacker-controlled network traffic - for example, via a man-in-the-middle position, a malicious website, or a rogue network endpoint capable of delivering crafted responses to Chrome's Passwords subsystem. User interaction is explicitly required (UI:R per CVSS); the victim must engage with the rendered spoofed UI element for the attack to produce its intended effect. No attacker authentication is required (PR:N). The vulnerability is bounded to integrity impact only (UI spoofing), with no confidentiality or availability consequence confirmed. The attack is constrained to the Passwords component specifically - general Chrome browsing outside of password-related UI flows is not implicated.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible flaw (AV:N) with low attack complexity (AC:L) and no attacker privileges required (PR:N), but mandatory user interaction (UI:R) and scope unchanged (S:U), with only an integrity impact (I:L) and no confidentiality or availability consequence. Chromium's own severity classification is 'Low,' aligning with the bounded impact. EPSS at 0.16% (6th percentile) independently confirms extremely low real-world exploitation probability. No KEV listing and no identified POC further reduce urgency. The compound requirement - malicious network traffic plus active user engagement with a spoofed UI element - makes this a targeted social-engineering enabler rather than a standalone compromise vector. No conflicting signals exist across available data sources; all indicators consistently point to low operational priority relative to severity.

An attacker in a position to inject or serve malicious network traffic - for example via a man-in-the-middle position on a local network, a rogue access point, or a controlled malicious website - crafts a response that triggers insufficient validation in Chrome's Passwords component, causing a spoofed password UI prompt to be displayed to the victim. The user, presented with a convincing but attacker-controlled credential dialog, may be deceived into confirming a credential save or interacting with the spoofed element in a way that benefits the attacker. No public POC exists at time of analysis, making opportunistic mass exploitation unlikely.