CVE-2026-17852 Google CVE debrief

Who should care

Organizations and individuals using Google Chrome versions prior to 151.0.7922.72 should be aware of this vulnerability and take necessary actions to update their browsers. Web developers and administrators should also be aware of the potential risks associated with same-origin policy bypass and implement best practices to mitigate these risks.

Technical summary

The CVE-2026-17852 vulnerability is caused by an inappropriate implementation in Media Router of Google Chrome prior to version 151.0.7922.72. This issue allows a remote attacker to bypass the same origin policy via a crafted HTML page. The vulnerability has a CVSS score of 6.5 and is classified as Medium severity by Chromium. The attack vector is network-based, requires low attack complexity, and no user interaction is required for exploitation.

Defensive priority

Medium severity vulnerability in Google Chrome prior to 151.0.7922.72, allowing remote attackers to bypass same origin policy via crafted HTML pages.

Recommended defensive actions

• Inventory and verify Google Chrome versions prior to 151.0.7922.72 are up-to-date
• Implement same-origin policy best practices for web applications
• Monitor for potential bypass attempts of same-origin policy
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-17852 vulnerability was identified in Google Chrome prior to version 151.0.7922.72. According to the NVD entry, this issue is related to an inappropriate implementation in Media Router, which could allow a remote attacker to bypass same origin policy via a crafted HTML page. The Chromium security severity of this issue is classified as Medium with a CVSS score of 6.5. Limited information is available about the specific details of the vulnerability and its potential impact.

Official resources