CVE-2026-17700: Google Chrome Information Disclosure Flaw

CVE-2026-17700 Overview

CVE-2026-17700 is an input validation vulnerability in the Actor component of Google Chrome prior to version 151.0.7922.72. Insufficient validation of untrusted input allows a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium engineers rated the internal severity as High, while the NVD CVSS 3.1 score is 4.3 (Medium). The flaw maps to CWE-20: Improper Input Validation and requires user interaction to trigger.

Critical Impact
An attacker who controls a compromised renderer process can bypass same-origin protections and exfiltrate data belonging to other web origins.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Actor component
Downstream builds that had not yet merged the upstream Chromium fix at time of publication

Discovery Timeline

2026-07-30 - CVE-2026-17700 published to NVD
2026-07-30 - Last updated in NVD database
2026-07 - Google releases Stable Channel update addressing the issue (see Google Chrome Update Announcement)

Technical Details for CVE-2026-17700

Vulnerability Analysis

The vulnerability resides in the Actor component of Chrome, which coordinates actions on behalf of the browser across renderer boundaries. The component fails to properly validate untrusted input received from a renderer process. An attacker who has already achieved renderer compromise, through a separate exploit chain, can pass malformed inputs that cause the Actor to operate outside its intended origin scope.

The result is a cross-origin information disclosure. Data from origins the attacker does not control becomes reachable through crafted HTML content processed by the compromised renderer. The EPSS probability is 0.288%, placing exploitation likelihood in the lower range at the time of publication.

Root Cause

The root cause is [CWE-20: Improper Input Validation]. The Actor component trusts fields supplied by the renderer without enforcing sufficient checks on origin, structure, or content. Because the renderer is designed to be a lower-trust process, any Actor logic that consumes renderer-supplied data must treat that data as adversarial. The missing validation breaks the site isolation boundary that Chrome relies on to keep cross-origin data segregated.

Attack Vector

Exploitation requires two conditions. First, the attacker must already have compromised the Chrome renderer process, typically through a separate memory corruption or type confusion vulnerability. Second, the victim must load a crafted HTML page under attacker control, satisfying the user interaction requirement in the CVSS vector.

Once those conditions are met, the attacker issues malformed requests to the Actor component from the compromised renderer. The Actor processes those requests without proper validation and returns or acts upon data belonging to another origin. The confidentiality impact is scored Low because the leak is bounded to what the Actor can access, with no direct integrity or availability effect.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for upstream technical detail as it becomes public.

Detection Methods for CVE-2026-17700

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints
Renderer process crashes or anomalous child-process behavior preceding suspicious outbound HTTPS traffic
Access to attacker-controlled HTML pages followed by exfiltration-style DNS or HTTP requests from the browser process

Detection Strategies

Inventory Chrome versions across the estate and flag any host running a build below 151.0.7922.72
Correlate browser process telemetry with network egress to identify renderer compromise chains that precede cross-origin data access
Monitor for unusual Chrome child process spawning, unexpected memory growth, or repeated renderer restarts that can indicate exploitation attempts against the renderer sandbox

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake so that renderer anomalies and outbound requests can be joined in a single query
Alert on user navigation to newly registered or low-reputation domains that serve HTML capable of driving renderer exploits
Track patch compliance dashboards for Chrome and Chromium-based browsers on a weekly cadence until full remediation is confirmed

How to Mitigate CVE-2026-17700

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after update deployment to ensure the patched binary is active in memory
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their vendor patches once they merge the upstream fix

Patch Information

Google addressed CVE-2026-17700 in the Stable Channel update to 151.0.7922.72. Administrators should consult the Google Chrome Update Announcement for the full advisory and the Chromium Issue Tracker Entry for upstream tracking. Enterprise deployments using managed update policies should verify that the update channel is not paused or pinned to an older milestone.

Workarounds

No official workaround eliminates the flaw; patching is the only complete remediation
Restrict browsing to trusted sites via enterprise policy where feasible to reduce exposure to malicious HTML
Enable site isolation and strict same-origin policies through Chrome enterprise policies to reduce residual attack surface until patches are applied

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version