Google Chrome CVE-2026-17957

Exploitation requires two explicit, sequential prerequisites: first, the attacker must have already compromised the victim's Chrome renderer process through a separate, unrelated vulnerability - this is a hard prerequisite making standalone exploitation of this CVE impossible; second, the victim must actively visit or be redirected to a crafted HTML page (UI:R). The CVSS AC:H metric reflects the complexity introduced by the renderer pre-compromise requirement. No authentication to any system or service is required for the CORS leak step itself (PR:N). Exploitation is constrained to Chrome versions below 151.0.7922.72, impacts only confidentiality at a limited level (C:L), and does not affect integrity or availability. The Low CVSS score (3.1) and Chromium's own 'Low' security severity designation are consistent with this chained, limited-impact profile.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects real-world risk. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N captures high attack complexity and mandatory user interaction, but does not fully express the critical implicit prerequisite stated in the description: a separate renderer process compromise must precede this exploit, making standalone exploitation impossible. SSVC signals reinforce low priority - Exploitation: none, Automatable: no, Technical Impact: partial. EPSS at 0.17% (7th percentile) confirms negligible real-world exploitation probability. There is no CISA KEV listing and no POC status in available intelligence. The confidentiality impact is limited in scope (S:U, C:L) with no integrity or availability component. This vulnerability presents essentially no standalone risk; its relevance is confined to multi-stage exploit chains targeting high-value Chrome users where a renderer exploit is already deployed.

An attacker who has separately exploited a Chrome renderer vulnerability (to achieve renderer process compromise on a target machine) then directs the victim to a crafted HTML page that triggers the CORS implementation flaw, causing Chrome to leak cross-origin response data - such as authenticated session content or sensitive API responses from a different origin - back to the attacker-controlled page. No public exploit code is identified in available intelligence, and the two-stage nature of the attack limits realistic exploitation to sophisticated threat actors with access to renderer-level Chrome exploits.