Google Chrome CVE-2026-17959

Exploitation requires that a victim user actively visit an attacker-controlled HTML page using Google Chrome prior to version 151.0.7922.72 - user interaction is a hard prerequisite per CVSS UI:R. The attacker requires no authentication or privileges (PR:N per CVSS). The vulnerability is specific to Chrome's network layer; other browsers are not confirmed affected. Exploitation is limited to confidentiality impact (cross-origin data leakage only); there is no code execution, integrity modification, or availability impact. The scope does not change beyond the victim's browser instance (S:U). Exploitation is constrained by the requirement for user interaction and is not automatable per SSVC, ruling out worm-like or drive-by mass exploitation at scale.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the constrained impact: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but user interaction mandatory (UI:R), with limited confidentiality impact only (C:L) and no integrity or availability consequence. EPSS at 0.17% (7th percentile) is very low, indicating negligible probability of observed exploitation in the near term. SSVC further reinforces this: exploitation status is none, the attack is not automatable, and technical impact is only partial. The absence from CISA KEV corroborates no confirmed active exploitation. Taken together, the signals consistently point to a real but low-priority vulnerability: the confidentiality exposure is bounded (cross-origin data fragments, not full credential theft), exploitation requires a victim to visit a malicious page, and mass automated exploitation is unlikely. Despite Chrome's ubiquitous deployment footprint, the combination of low EPSS, no known exploit, and non-automatable attack vector means this is not an emergency - but Chrome's auto-update mechanism makes patching trivial.

An attacker hosts a crafted HTML page containing network requests engineered to exploit Chrome's improper origin validation. When a victim navigates to the page using an unpatched Chrome browser, the page triggers cross-origin network interactions that the browser incorrectly permits, leaking fragments of authenticated cross-origin responses - such as partial page content from a logged-in session at another site - back to the attacker. No public exploit code has been identified at time of analysis, and the SSVC assessment confirms exploitation is not automatable, making targeted rather than mass-scale attacks the realistic threat model.