Google Chrome CVE-2026-17942

Exploitation requires that the victim user actively visit an attacker-controlled HTML page - drive-by exploitation without any navigation action is not possible (CVSS UI:R confirmed). The attack is valuable only when the victim's browser simultaneously has access to cross-origin resources the attacker wishes to probe, such as an authenticated session on a separate-origin web application; a victim browsing isolated from sensitive cross-origin resources yields no meaningful leakage. No authentication to the attacker's page is required (CVSS PR:N). SSVC automatable:no confirms that mass-scale automated campaigns against arbitrary users are not feasible, limiting this to targeted scenarios. The vulnerability is specific to Chrome's SVG processing path prior to 151.0.7922.72; other browsers are not indicated as affected by available data. The low EPSS (0.17%) and SSVC exploitation:none status further confirm no opportunistic exploitation has been observed.

The NVD CVSS 4.3 (Medium) vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-accessible attack with no privilege requirement, but mandates user interaction and produces only low confidentiality impact with no integrity or availability consequence. EPSS at 0.17% (7th percentile) indicates extremely low observed exploitation probability in the wild, consistent with SSVC's explicit 'exploitation: none' finding and the automatable:no assessment - mass exploitation is structurally impossible due to the UI:R requirement. The Chromium team itself rated severity as 'Low.' These signals are internally consistent and paint a coherent picture: this is a real privacy-class flaw but a low operational priority. The primary gap in the official CVSS assessment is that AC:L may understate difficulty; side-channel attacks require careful calibration of measurement conditions in practice, suggesting higher real-world complexity. No KEV listing, no public exploit code, and no POC have been identified. High-security environments handling sensitive cross-origin authenticated sessions (e.g., internal tooling, financial portals) should treat this with modestly elevated concern relative to general enterprise environments.

An attacker hosts a malicious web page embedding crafted SVG elements with JavaScript timing measurement loops. When a victim user navigates to the page while simultaneously authenticated to a sensitive cross-origin web application (such as an internal portal or financial service), the SVG rendering triggers measurable side-channel signals - timing differentials or cache-state variations - that the attacker's JavaScript captures and processes to infer fragments of the victim's cross-origin session data. No public exploit code exists at time of analysis, and reliable exploitation in practice requires careful calibration of measurement timing against the target environment.