CVE-2026-17748 is a vulnerability in Google Chrome's Extensions component affecting versions before 151.0.7922.72. It allows a remote attacker, who has already compromised the renderer process, to bypass site isolation protections by using a specially crafted HTML page. The vulnerability is classified under CWE-346 (Inadequate Verification of Data Authenticity) and has a CVSS 3.1 base score of 6.5 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked indicates a stable channel update addressing this issue, implying a fix is available in version 151.0.7922.72.

An attacker who has compromised the renderer process can bypass site isolation, potentially allowing them to interfere with the integrity of web content across different sites. There is no direct confidentiality or availability impact reported. The vulnerability could facilitate further attacks by undermining Chrome's security boundary between sites.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.