CVE-2026-17905: Google Chrome Information Disclosure Flaw

CVE-2026-17905 Overview

CVE-2026-17905 is an inappropriate implementation flaw in the SurfaceCapture component of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Low, but the flaw undermines the same-origin policy, a core browser security boundary.

The vulnerability affects Chrome's screen and surface capture pipeline, which is used by web APIs such as getDisplayMedia() and related tab/window capture mechanisms. Exploitation requires no authentication and only user interaction with an attacker-controlled page.

Critical Impact
Cross-origin data leakage through the SurfaceCapture implementation, weakening browser isolation between origins and exposing sensitive content rendered from other sites.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable SurfaceCapture implementation
Downstream distributions bundling pre-151 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17905 published to NVD
2026-07-30 - Last updated in NVD database
Fix shipped in Chrome Stable channel version 151.0.7922.72 per the Google Chrome Desktop Update

Technical Details for CVE-2026-17905

Vulnerability Analysis

The defect resides in Chrome's SurfaceCapture code path, which handles video frame capture from browser surfaces including tabs, windows, and displays. The implementation does not adequately enforce origin boundaries on captured pixel data. An attacker-controlled page can observe frames or derived data that originate from a different origin.

This class of flaw is categorized as an Information Disclosure vulnerability with a cross-origin scope. The impact is confidentiality-focused rather than involving code execution or memory corruption. Sensitive content such as authenticated pages, tokens rendered in the DOM, or private user interfaces may be exposed to an attacker.

Root Cause

The root cause is an inappropriate implementation in surface capture logic that fails to consistently apply cross-origin restrictions. Browser capture APIs must taint or block frames sourced from origins the requesting document is not permitted to read. When these checks are incomplete or bypassed, the browser exposes cross-origin pixels to script executing under a different origin.

Review the Chromium Issue #497366217 tracker entry for authoritative technical context.

Attack Vector

The attack vector is remote and web-based. An attacker hosts a crafted HTML page and lures a victim using pre-151 Chrome to visit it. The page invokes surface capture flows in a manner that triggers the flaw, then reads back cross-origin content the attacker should not have access to.

No authentication is required, and no additional privileges are needed on the target system. Because verified proof-of-concept code has not been published, the vulnerability is described in prose only. Refer to the linked Chromium issue for authoritative details.

Detection Methods for CVE-2026-17905

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in enterprise inventory data
Web traffic to untrusted domains that invoke getDisplayMedia() or related surface capture APIs shortly after page load
Unexpected user prompts for screen, tab, or window sharing originating from low-reputation sites

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome build below 151.0.7922.72
Correlate web proxy logs with browser telemetry to identify sessions that requested display capture from newly registered or low-reputation domains
Alert on JavaScript on untrusted origins that references MediaDevices.getDisplayMedia or CaptureController shortly after navigation

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and enforce automatic updates
Monitor DNS and HTTP telemetry for user visits to unknown domains that trigger capture permission prompts
Review browser extension and site permission grants for display-capture on non-corporate origins

How to Mitigate CVE-2026-17905

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched binary is loaded
Validate patch deployment status across the fleet using endpoint management reports

Patch Information

Google addressed CVE-2026-17905 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Administrators should confirm that endpoints report 151.0.7922.72 or a later version. Chromium-based browsers should pull the corresponding upstream fix before being considered patched.

Workarounds

Restrict the display-capture permission through enterprise browser policy on untrusted origins
Deploy allowlists for sites permitted to invoke screen or tab capture using Chrome enterprise policies such as ScreenCaptureAllowedByOrigins
Advise users to deny surface capture prompts originating from unfamiliar websites until patching completes

bash

# Configuration example: Chrome enterprise policy to restrict display capture
# Windows: HKLM\Software\Policies\Google\Chrome
# macOS:   /Library/Preferences/com.google.Chrome.plist

ScreenCaptureAllowed = false
ScreenCaptureAllowedByOrigins = [
  "https://meet.corp.example.com",
  "https://approved-collab.example.com"
]