Google Chrome CVE-2026-17956

Exploitation requires the victim to actively open or navigate to an attacker-crafted HTML page (UI:R in the CVSS vector confirms required user interaction) using a vulnerable Chrome build prior to 151.0.7922.72; no authentication or prior privileges are needed (PR:N). The critical limiting factor is that resulting code execution is confined to the renderer sandbox (scope Unchanged, S:U), so absent a chained sandbox-escape the attacker does not gain host-level control - this is why Google rated it Low severity. There is no special non-default configuration or platform restriction called out; the condition is simply an unpatched Chrome desktop instance rendering malicious HTML with user interaction.

Signals conflict and must be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects network reach, low complexity, no privileges, and full CIA impact, but crucially scope is Unchanged (S:U) and the description confines execution to the sandbox - meaning impact is bounded to the renderer, not the host. This contrasts sharply with Google's own 'Chromium security severity: Low' rating and CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: total). EPSS was not provided in the input. There is no public exploit identified and the CVE is not in CISA KEV, so this is not an active-exploitation priority. Net assessment: this is a high-CVSS-but-lower-real-risk issue in isolation - a sandboxed RCE is only dangerous when chained with a separate sandbox-escape, which is why Google scored it Low. Verify: the 8.8 score assumes full host impact, but 'inside a sandbox' plus S:U suggests the practical technical impact to the host is limited unless chained.

An attacker hosts a crafted HTML page and lures a victim to open it via phishing, a malicious ad, or a compromised legitimate site. When the victim's unpatched Chrome renders the page, the Scheduling flaw is triggered and the attacker executes arbitrary code inside the renderer sandbox. No public exploit is identified, and to reach the host the attacker would need to chain a separate sandbox-escape vulnerability.