CVE-2026-17743 describes an insufficient policy enforcement vulnerability in the ControlledFrame feature of Google Chrome versions before 151.0.7922.72. This weakness permits a remote attacker to bypass the same origin policy by crafting a malicious HTML page. The vulnerability is tracked under CWE-346 (Origin Validation Error) and is rated medium severity with a CVSS 3.1 base score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can bypass the same origin policy, potentially allowing unauthorized script execution or manipulation of content across different origins. This compromises the integrity of web content isolation but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

The vulnerability is fixed in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the issue. The vendor advisory linked provides the official update information. No additional mitigation steps are indicated.