Google Chrome CVE-2026-17943

The victim must actively navigate to an attacker-controlled or attacker-modified HTML page using a vulnerable Google Chrome version (prior to 151.0.7922.72) - user interaction is required (UI:R in CVSS). No special browser configuration, extension, or feature flag is needed; the flaw is in the default parser behavior. No authentication or elevated privileges are required from the attacker (PR:N). Exploitation is limited by: (1) the mandatory user interaction - the victim must visit the malicious page, preventing automated/worm-style propagation (SSVC Automatable: no); (2) the impact being integrity-only with no confidentiality or availability loss, constraining what an attacker achieves through this vulnerability alone; and (3) the attack being unscoped (S:U), meaning the bypass affects only the targeted page's CSP context and does not elevate to system-level access.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) indicates a network-reachable, low-complexity attack requiring no privileges, but critically dependent on user interaction - the victim must actively visit an attacker-controlled page. The impact is bounded to partial integrity loss (I:L) with no confidentiality or availability consequence, meaning an attacker can bypass CSP but cannot directly exfiltrate data or crash the browser through this vulnerability alone. SSVC confirms: exploitation is none, the attack is not automatable, and technical impact is only partial - all consistent with EPSS of 0.18% at the 8th percentile, signaling very low real-world exploitation likelihood. The 'Authentication Bypass' tag in the source data appears inconsistent with the CVE description, which describes a CSP bypass, not authentication bypass in the traditional sense; that tag should be treated with caution and may reflect a broad categorical label. In isolation, this is not a high-priority remediation item; however, CSP bypasses can serve as a prerequisite step in a chained attack where a separate XSS is present on the same origin, elevating combined risk.

An attacker registers or compromises a website and serves a specially crafted HTML page designed to exploit the parser's CSP enforcement flaw. A victim running Chrome prior to 151.0.7922.72 is directed to the page via a phishing email, malicious advertisement, or injected link, and upon visiting it, Chrome's parser processes the HTML in a way that bypasses the page's CSP directives. This could allow attacker-controlled scripts or resources - normally blocked by CSP - to load and execute in the victim's browser session. No public exploit code exists at time of analysis.