Google Chrome CVE-2026-17975

Exploitation requires the victim to be running Google Chrome on macOS (not Windows or Linux) at a version below 151.0.7922.72. The CVSS vector (UI:R) confirms the victim must actively visit the attacker-controlled HTML page; drive-by exploitation without any user interaction is not indicated. No authentication or special server-side configuration is required from the attacker's perspective (PR:N). The vulnerability is tied to Chrome's IME implementation on macOS specifically, meaning it does not affect Chrome on other operating systems. The exact memory regions exposed are described only as 'potentially sensitive,' meaning the practical exploitability for targeted credential theft is uncertain. Limiting factors include the macOS-only platform scope, requirement for user navigation to a crafted page, and the indeterminate nature of what process memory can be disclosed.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity attack requiring no authentication but needing user interaction to visit a page - a realistic bar for phishing or malvertising campaigns. The C:H impact metric assumes worst-case process memory contents (credentials, tokens, PII), which is theoretically possible but unconfirmed by the description's 'potentially sensitive' qualifier. Chromium's own 'Low' severity rating diverges from the CVSS Medium score and likely reflects that the disclosed memory contents are unpredictable and not reliably exploitable for targeted data theft. EPSS at 0.17% (7th percentile) aligns with Chromium's assessment - very low real-world exploitation activity expected. No CISA KEV listing and no known POC further reduce urgency. The macOS-only scope eliminates risk for Windows and Linux Chrome deployments. For most organizations, patching through the standard Chrome update cycle is sufficient; emergency remediation is not warranted unless the environment has a high concentration of macOS users handling extremely sensitive in-browser data.

An attacker registers a malicious domain and serves a crafted HTML page engineered to trigger the IME code path in Chrome on macOS - potentially through JavaScript-driven text composition events or hidden input fields designed to interact with the macOS IME subsystem. A macOS user running an unpatched Chrome version is lured to the page via phishing email or a compromised advertisement, and upon page load the IME implementation leaks fragments of the Chrome renderer process memory back to attacker-controlled JavaScript or via a network side-channel. No public POC is known, making this scenario currently theoretical.