CVE-2026-17674 is a high severity vulnerability in Google Chrome affecting versions before 151.0.7922.72. The flaw involves an inappropriate implementation in HTML that enables remote attackers to bypass the content security policy (CSP) by using a specially crafted HTML page. This bypass could undermine the security controls intended to restrict resource loading and script execution, potentially leading to security policy violations. The vulnerability is publicly disclosed with a vendor advisory available, but no explicit patch or remediation status is confirmed in the provided data.

The vulnerability allows remote attackers to bypass the content security policy in affected versions of Google Chrome. This can lead to the execution of unauthorized scripts or loading of unauthorized resources, potentially compromising the security model of web applications relying on CSP for protection. No known exploits in the wild have been reported at the time of this disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to the latest stable version once a fix is available. Until then, no specific mitigation steps are provided by the vendor.