CVE-2026-17797 Google CVE debrief

Who should care

IT administrators and security teams responsible for managing Google Chrome installations, as well as developers and users concerned with web browser security, should be aware of this vulnerability. They should review their inventory of Google Chrome installations and ensure all instances are running the latest version. Additionally, they should monitor Google Chrome logs and network traffic for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability's impact on various platforms and systems should also be considered, and asset owners should be notified and involved in the remediation process.

Technical summary

A Medium severity UXSS vulnerability was discovered in Google Chrome prior to version 151.0.7922.72. The vulnerability, tracked as CVE-2026-17797, allows remote attackers to inject arbitrary scripts or HTML via a crafted HTML page. This can lead to potential security risks, including script injection attacks. The vulnerability's technical details are based on official sources, but additional context is needed to fully understand the issue.

Defensive priority

Medium severity UXSS vulnerability in Google Chrome, requiring immediate attention to prevent potential script injection attacks.

Recommended defensive actions

• Apply the latest Google Chrome update (version 151.0.7922.72 or later) to prevent potential script injection attacks.
• Review and update inventory of Google Chrome installations to ensure all instances are running the latest version.
• Monitor Google Chrome logs and network traffic for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from official sources indicates a Medium severity UXSS vulnerability in Google Chrome prior to version 151.0.7922.72. The vulnerability allows remote attackers to inject arbitrary scripts or HTML via a crafted HTML page. Limited source detail is available, and defenders should verify the vulnerability's impact and affected scope. Additional verification tasks are recommended to ensure the accuracy of the information.

Official resources