Google Chrome CVE-2026-17977

Exploitation requires that the victim user actively navigates to an attacker-controlled web page containing crafted HTML and CSS - confirmed by CVSS UI:R. The attacker requires no special network position (AV:N), no authentication (PR:N), and no elevated privileges on the victim's system. The attack is not automatable (SSVC: Automatable: no), meaning mass drive-by exploitation is not feasible without user interaction. Limiting factors: the victim must click or be redirected to the malicious page; the vulnerability affects Chrome's CSS engine specifically and does not apply to other browser engines (Firefox, Safari, Edge on non-Chromium base); only Chrome versions below 151.0.7922.72 are affected. The specific CSS feature or configuration required to trigger the bypass is not publicly disclosed, adding an additional practical barrier to exploitation.

The CVSS 4.3 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately characterizes a low-to-moderate real-world risk. While the attack is network-reachable and requires no attacker authentication, the mandatory user interaction (UI:R - victim must navigate to a crafted page) prevents automated, opportunistic exploitation, a finding corroborated by SSVC's 'Automatable: no' assessment. EPSS at 0.18% (8th percentile) is exceptionally low, confirming negligible exploitation probability in the near term. The absence of a CISA KEV listing and SSVC's 'Exploitation: none' designation indicate no observed in-the-wild abuse. Impact is constrained to partial confidentiality loss (C:L) - cross-origin data leakage only - with no integrity or availability impact. Chrome's own 'Low' security severity rating aligns with these signals. This vulnerability represents a real but non-urgent risk; the primary threat model is targeted phishing-style attacks against specific individuals rather than mass exploitation. Prioritization should reflect Chrome's ubiquitous deployment footprint: patch broadly but without emergency urgency.

An attacker hosts a crafted web page containing malicious CSS that exploits Chrome's origin validation failure to read data from a cross-origin resource - for example, content from an authenticated intranet application or a third-party site the victim is logged into. The victim is lured to the attacker's page via phishing or a malicious link, and the CSS policy bypass silently extracts and exfiltrates the cross-origin data to an attacker-controlled endpoint. No public exploit code is known at time of analysis, making this attack non-trivial to reproduce without independent research.