Google Chrome CVE-2026-17970

Two concrete conditions must both be satisfied: (1) The attacker must occupy a privileged network position - specifically, the ability to intercept and inject into network traffic between the Chrome client and a remote server (e.g., same local network segment, rogue access point, compromised gateway, or ARP poisoning). Arbitrary internet-based attackers cannot exploit this remotely without such positioning. (2) The victim user must interact with the spoofed UI element (UI:R per CVSS vector) - passive browsing alone is insufficient. Exploitation is limited to the integrity dimension only; no confidentiality or availability impact applies. The Chromium project's own Low severity rating reflects these restrictive preconditions.

The NVD CVSS 4.3 score reflects an AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N vector, but the AC:L rating is in tension with the description's explicit requirement for 'a privileged network position' - a MITM precondition that CVSS 3.1 guidance typically maps to AC:H. This discrepancy should be noted; the independently assessed vector below raises AC to H. Real-world risk is further tempered by an EPSS of 0.11% (2nd percentile), absence from CISA KEV, no known public proof-of-concept, and impact limited exclusively to UI integrity (no credential exfiltration, no code execution, no availability loss). The privileged network position prerequisite makes opportunistic, internet-scale exploitation infeasible. This is a genuine low-priority issue best addressed through routine Chrome update cadence rather than emergency response.

An attacker controlling a Wi-Fi access point or router on a network shared with the victim intercepts Chrome's network traffic and injects a maliciously crafted response targeting the Passwords component. This causes a spoofed password-related dialog or UI indicator to appear in the victim's browser session. When the user interacts with the spoofed element - for example, confirming a fake credential save or dismissing a fraudulent prompt - the attacker achieves the intended social-engineering or integrity-undermining outcome. No public proof-of-concept code exists at the time of this analysis.