Google Chrome CVE-2026-17992

User interaction is required - the victim must visit a crafted HTML page (UI:R per CVSS), meaning passive network exposure alone is insufficient. The vulnerability is platform-specific to Chrome on Windows; users on macOS, Linux, or mobile Chrome versions are not affected per the CVE description. No authentication or special privileges are required from the attacker side (PR:N), but the attacker must be able to deliver the crafted page to the victim. The Skia code path that triggers the uninitialized read must be exercised by specific HTML or graphical content structures, which are not publicly documented. Limiting factors include Chrome's renderer sandbox (constraining accessible memory), the Windows-only scope, and the requirement for active user navigation to the malicious page. No special server-side configuration of the victim's Chrome instance is needed beyond running an unpatched Windows version.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity attack requiring only user interaction, with high confidentiality impact. However, multiple corroborating signals substantially temper real-world priority: EPSS at 0.19% (9th percentile) indicates very low exploitation probability; SSVC classifies exploitation as none and technical impact as partial; and the vulnerability is not listed in the CISA KEV catalog. The CVSS C:H rating is theoretically justified by uncontrolled memory disclosure but is likely conservative - actual data sensitivity depends on what occupies the uninitialized memory at the time of exploitation, which is non-deterministic. The Chromium team rated this Low severity internally, consistent with limited practical impact. Chromium's sandbox architecture also constrains what memory the renderer process can access, reducing the blast radius of any disclosed data. No conflicting signals are present - all intelligence sources align toward low active risk. This is a patch-and-move-on issue rather than an emergency response item.

An attacker serves a specially crafted HTML page that triggers a specific Skia rendering code path on Windows, causing Chrome to read and potentially expose uninitialized heap or stack memory from the renderer process. A victim on Windows using an unpatched Chrome version visits the page - via a phishing link, malicious advertisement, or compromised website - and the memory disclosure occurs silently during page rendering. No public proof-of-concept code exists at time of analysis, and the non-deterministic nature of uninitialized memory contents limits the reliability of any exploit targeting specific secrets.