CVE-2026-17706 is a security vulnerability in Google Chrome's Media component on Windows platforms before version 151.0.7922.72. It involves insufficient validation of untrusted input, which can be exploited by a remote attacker who has already compromised the renderer process to leak cross-origin data through a specially crafted HTML page. This vulnerability does not affect integrity or availability but impacts confidentiality by allowing data leakage. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

An attacker who has compromised the renderer process can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins. There is no impact on data integrity or availability. The vulnerability requires user interaction and does not require privileges, making it a moderate confidentiality risk.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides official update information. No additional mitigations are specified or required beyond applying the update.