Google Chrome CVE-2026-17996

Exploitation requires local access to the target macOS machine - the attacker must be able to place or reference a malicious file that Chrome processes. The CVSS vector (AV:L/PR:N/UI:N) indicates no privileges are required within Chrome or the OS beyond local system presence, and no explicit user interaction (such as clicking a link) is needed beyond whatever mechanism delivers the malicious file. The vulnerability is macOS-platform-specific; Chrome on other operating systems is not affected. Scope is limited to navigation restriction bypass only - no remote attack path, no code execution, and no confidentiality or availability impact. Defenders can treat this as low urgency unless the threat model includes malicious local users or physical access scenarios.

Multiple signals converge to indicate low real-world risk despite a 6.2 CVSS score. The attack vector is local (AV:L), requiring physical or logical access to the target macOS system - this substantially limits the attacker population and excludes remote exploitation. EPSS at 0.10% (1st percentile) indicates the vulnerability is among the least likely to be exploited in the near term. There is no CISA KEV listing and no public exploit code identified at time of analysis. The impact is integrity-only (I:H, C:N, A:N), meaning data exfiltration or denial-of-service are not direct outcomes. Chromium's own team rated this Low severity, aligning with the EPSS signal. The primary threat model is a malicious insider or an attacker who has already achieved local access - at which point many higher-impact vectors are available. No conflicting signals identified; CVSS, EPSS, KEV, and vendor severity rating are all consistent.

A local attacker on a shared macOS system or a user who has obtained limited local access places a crafted malicious file in a location accessible to Chrome. When Chrome processes or navigates to this file - without requiring any special privilege escalation or interaction - the inappropriate implementation fails to enforce navigation restrictions, allowing the attacker to reach content or origins that should be blocked, resulting in a high-integrity impact to the browser's security boundary. No public exploit code is known, and Chromium's internal Chromium bug tracker issue (https://issues.chromium.org/issues/521473427) is the only confirmed technical reference.