Google Chrome CVE-2026-17966

Exploitation requires that the attacker either has local access to the macOS machine or can deliver a crafted HTML file that the victim opens in Chrome on macOS. The vulnerability is platform-specific: only macOS builds of Chrome prior to 151.0.7922.72 are affected - Windows, Linux, and mobile Chrome are not listed as vulnerable. The CVSS vector asserts no user interaction (UI:N), but the description explicitly invokes a 'crafted HTML page', implying the victim's browser must render attacker-controlled content; this creates a practical barrier not fully reflected in the vector. Impact is limited to confidentiality (no integrity or availability impact); the attacker gains read access to portions of browser process memory but cannot modify data or crash the process.

The CVSS 3.1 base score of 6.2 (Medium) is driven almost entirely by the High confidentiality impact (C:H); attack complexity is Low and no privileges are required per the vector, which inflates the score relative to real-world risk. Crucially, the attack vector is Local (AV:L), meaning exploitation is inherently constrained to attackers with local presence or the ability to deliver and execute a crafted HTML page on the target machine. EPSS at 0.11% (2nd percentile) reinforces that this vulnerability is not being leveraged in active campaigns. There is no CISA KEV listing and no known POC. Chrome's own severity classification of 'Low' reflects this realistic risk profile. One notable inconsistency: the CVSS vector asserts UI:N (no user interaction), yet the description explicitly requires a 'crafted HTML page' to trigger the flaw, which implies at minimum that a user must open or render that page - this discrepancy should be verified against the Chromium issue tracker at issues.chromium.org/issues/518058990. Overall, this is a patch-and-move-on issue with low operational urgency unless sensitive data processed by Chrome on macOS is a specific threat model concern.

A local attacker on a macOS system places a specially crafted HTML file on the filesystem and induces the target user to open it in Chrome - for example, via a shared network drive, downloaded file, or social engineering. The crafted page triggers the Views implementation flaw, causing Chrome to read and potentially expose adjacent process memory contents that may include authentication tokens, cached page data, or other sensitive browser state. No public POC exists and no active exploitation has been observed.