Google Chrome CVE-2026-17958

The victim must actively visit an attacker-controlled HTML page in Chrome prior to 151.0.7922.72 - user interaction is a hard requirement (CVSS UI:R). The CVSS vector (PR:N) confirms no authentication or account on the target system is needed by the attacker. Attack complexity is low (AC:L), meaning no race condition or special timing is required once the victim loads the page. The scope is unchanged (S:U), so exploitation is limited to the Chrome process and browser UI context - no OS-level privilege escalation is implied. Limits on exploitation: victim must navigate to the malicious page; the impact is restricted to UI integrity (C:N, A:N); and no automation path has been identified (SSVC automatable: no).

Real-world risk is modest despite the network attack vector. CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) captures the low integrity impact and lack of confidentiality or availability consequence. EPSS at 0.17% (7th percentile) signals near-negligible community-observed exploitation probability. SSVC confirms exploitation status as none and automatable as no, meaning mass scanning or weaponization is unlikely given the UI:R requirement. The vulnerability is not in CISA KEV. The practical risk concentrates on targeted social-engineering scenarios - an attacker directing a specific victim to a malicious page - rather than opportunistic or automated attacks. The 'Information Disclosure' tag in the source intelligence is slightly misleading; CWE-451 is about UI misrepresentation rather than data exfiltration, and the CVSS vector assigns C:N, so no direct information disclosure is confirmed. The Google-assigned severity of Low is consistent with all available signals.

An attacker constructs a crafted HTML page that triggers the inappropriate Views rendering behavior and distributes it via phishing email or malicious advertisement. A victim running Chrome prior to 151.0.7922.72 clicks the link and loads the page, at which point the browser's UI is spoofed - for example, presenting a fake security dialog or misrepresenting the page origin - potentially tricking the user into entering credentials or approving a permission. No public proof-of-concept has been identified at time of analysis.