CVE-2026-17942: Google Chrome SVG Information Disclosure

CVE-2026-17942 Overview

CVE-2026-17942 is a side-channel information leakage vulnerability in the Scalable Vector Graphics (SVG) implementation of Google Chrome prior to version 151.0.7922.72. A remote attacker can exfiltrate cross-origin data by serving a crafted HTML page to a victim browser. The Chromium project rated the security severity as Low. The weakness is classified under CWE-1300: Improper Protection of Physical Side Channels, reflecting an information disclosure primitive rather than direct code execution.

Critical Impact
Remote attackers can leak cross-origin data from a victim's browser session by luring the user to a crafted HTML page that abuses SVG rendering behavior.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers sharing the affected SVG rendering code paths
Downstream browsers pending merge of the upstream Chromium fix

Discovery Timeline

2026-07-30 - CVE-2026-17942 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database
Additional vendor context is available in the Google Chrome Stable Update and the Chromium Issue Tracker Entry.

Technical Details for CVE-2026-17942

Vulnerability Analysis

The vulnerability resides in Chrome's SVG subsystem. SVG documents can embed and reference cross-origin resources through filters, images, and paint servers. When Chrome processes these referenced resources, timing or rendering side effects can vary based on the content of the cross-origin data. An attacker who observes those side effects can infer information that the same-origin policy is supposed to protect. The flaw maps to [CWE-1300], covering side-channel disclosures that bypass logical isolation.

Side-channel disclosures of this class typically require the victim to load attacker-controlled markup. The attacker measures rendering time, paint order, or resource loading behavior to reconstruct bytes of the protected cross-origin response. Even a Low-severity leak of this type can be chained with other primitives to build broader identification or data exfiltration flows.

Root Cause

The root cause is insufficient isolation between SVG rendering operations and the content of cross-origin resources they reference. Rendering paths that should be data-oblivious instead exhibit observable variance tied to protected content. Google has not released a public technical write-up beyond the fix commit tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation follows a browser-initiated flow. The attacker hosts a crafted HTML page containing SVG constructs that reference cross-origin data. The victim visits the page through a link, advertisement, or embedded iframe. The malicious page then measures observable side effects, such as timing or paint behavior, and derives cross-origin information. No user interaction beyond page navigation is required.

No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported for CVE-2026-17942. See the vulnerability descriptions in the Google Chrome Stable Update and the Chromium Issue Tracker Entry for further context.

Detection Methods for CVE-2026-17942

Indicators of Compromise

No public indicators of compromise, malware hashes, or attacker infrastructure have been associated with CVE-2026-17942.
Look for user reports of unexpected redirects to unknown domains hosting SVG-heavy content immediately before sensitive-session anomalies.
Correlate browser version telemetry to identify endpoints still running Chrome builds earlier than 151.0.7922.72.

Detection Strategies

Inventory installed browser versions across the fleet and flag any Chrome or Chromium-derived browser below 151.0.7922.72.
Inspect web proxy logs for outbound requests to newly registered domains serving pages with high volumes of SVG <use>, <image>, or filter references to third-party origins.
Alert on browser processes fetching cross-origin assets from unfamiliar hosts shortly after visits to untrusted pages.

Monitoring Recommendations

Enable centralized browser management with update compliance reporting to enforce a minimum Chrome build.
Ingest proxy and DNS telemetry into a central analytics platform and pivot on referrer chains that terminate in SVG-heavy attacker pages.
Track the Chromium Issue Tracker Entry for any follow-on advisories referencing the same code path.

How to Mitigate CVE-2026-17942

Immediate Actions Required

Update Google Chrome to 151.0.7922.72 or later on every managed endpoint, including remote and BYOD devices.
Restart Chrome after the update to ensure the patched renderer processes replace vulnerable ones.
Coordinate with vendors of Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, to confirm their patched builds are deployed.

Patch Information

Google addressed CVE-2026-17942 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fixed version is 151.0.7922.72. Enterprises using Chrome Browser Cloud Management or group policy should force the update rollout rather than rely on user-initiated restarts.

Workarounds

Restrict user browsing to trusted sites through URL filtering until all endpoints reach the patched Chrome build.
Deploy a Content Security Policy on internal applications that limits third-party SVG embedding and reduces cross-origin exposure.
Educate users to avoid unfamiliar links and to report unexpected browser behavior on pages that render heavy SVG content.

bash

# Verify the installed Chrome version on Linux, macOS, and Windows endpoints
google-chrome --version                     # Linux
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version   # macOS
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version                # Windows

# Expected output: version 151.0.7922.72 or later