Google Chrome CVE-2026-17997

A critical and non-trivial prerequisite is that the attacker must have already compromised the Chrome renderer process through a separate vulnerability - this CVE cannot be exploited in isolation and does not itself provide a path to renderer compromise. Additionally, user interaction is required (UI:R per CVSS): the victim must visit or interact with a crafted HTML page while the renderer is under attacker control. The vulnerable behavior is specific to Chrome's Passwords component, meaning the target must have Chrome's password functionality active. Attack complexity is High (AC:H), consistent with the renderer pre-compromise requirement and the non-automatable SSVC classification. Factors that further limit real-world exploitation: the attack cannot be automated or mass-deployed; impact is confidentiality-only at limited scope (C:L); no integrity or availability impact applies; and the vulnerability is not exploitable in default Chrome configurations without the renderer compromise prerequisite being met first.

All available signals converge on low real-world priority. The CVSS 3.1 base score of 3.1 (Low) is driven by AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - high attack complexity reflecting the renderer pre-compromise requirement, mandatory user interaction, and a confidentiality-only impact of limited scope. EPSS at 0.16% places this in the 6th percentile, indicating negligible exploitation probability relative to the broader CVE population. SSVC confirms exploitation status as none, the attack as non-automatable, and technical impact as only partial. This CVE is not in CISA KEV. The single most significant risk-limiting factor is that exploitation is impossible without first achieving renderer process compromise - itself typically a Critical or High severity precondition. In isolation, this CVE cannot be weaponized. As a chained second stage following a renderer exploit, it contributes limited incremental value (C:L only). No conflicting signals were identified across sources.

An attacker who has successfully exploited a separate, higher-severity renderer vulnerability in Chrome - gaining code execution within the sandboxed renderer process - then navigates the victim's browser to a crafted HTML page that leverages the Passwords component's origin validation flaw to read cross-origin password data. This two-stage chain requires the victim to be using an unpatched Chrome version and to interact with attacker-controlled content during the session in which renderer compromise has already occurred. No public exploit code has been identified for CVE-2026-17997 specifically.