Google Chrome CVE-2026-17974

Exploitation requires a victim to open a crafted HTML page in a version of Google Chrome prior to 151.0.7922.72, constituting mandatory user interaction (UI:R per CVSS). The CVE description explicitly identifies a 'local attacker' as the threat actor, suggesting the attack may depend on local delivery of the crafted page rather than remote network delivery - this conflicts with the AV:N CVSS metric and should be verified with the vendor. DevTools must be accessible in the browser, which is the default state for standard Chrome installations (not enterprise-restricted deployments). Exploitation is limited by: required user interaction (victim must actively open the crafted page), the local attacker context stated in the description, the absence of scope change (S:U), and Google's own low-severity classification. The CVSS PR:N metric indicates no attacker authentication or privileges are required to craft the malicious page.

Despite a CVSS 3.1 base score of 6.5 with an integrity-high impact rating, multiple signals collectively indicate low real-world exploitation priority. The EPSS score of 0.12% at the 2nd percentile reflects near-negligible automated exploitation probability. Google's internal Chromium security team rated this 'Low' severity, which is atypical for high-integrity-impact vulnerabilities and suggests constrained practical impact. The attack requires user interaction (UI:R), meaning passive delivery is insufficient - a victim must actively open the crafted HTML page. A notable conflict exists between the CVE description, which specifies 'local attacker', and the provided CVSS AV:N vector; these designations are inconsistent and should be verified against the vendor advisory. If the local attacker characterization is accurate, the real-world attack surface is substantially narrower than AV:N implies. No public exploit code and no CISA KEV listing further reduce urgency. This is a low-real-world-risk finding that warrants patching on a normal update cycle but does not require emergency response.

A local attacker prepares a crafted HTML page that triggers insufficient policy enforcement within Chrome's DevTools component. When the targeted user opens this page in an unpatched version of Chrome (prior to 151.0.7922.72), the attacker's page subverts navigation restrictions, potentially redirecting the browser to attacker-controlled destinations or bypassing navigation-based security controls. No public exploit code has been identified at time of analysis, and the low EPSS score and Google 'Low' severity rating suggest exploitation remains theoretical.