The vulnerability CVE-2026-17756 involves insufficient policy enforcement in the Presentation component of Google Chrome versions before 151.0.7922.72. This flaw enables remote attackers to bypass navigation restrictions by crafting a malicious HTML page. The issue is classified under CWE-602 (Improper Restriction of XML External Entity Reference). The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There are no known exploits in the wild. The vendor advisory link is provided but does not explicitly state if a fix has been released.

Successful exploitation allows a remote attacker to bypass navigation restrictions in the Presentation feature of affected Chrome versions, potentially leading to unauthorized actions that impact the integrity of the browsing session. There is no confidentiality or availability impact reported. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official confirmation of a fix is available, users should exercise caution with untrusted HTML content that could exploit navigation restrictions in Chrome's Presentation feature.