This vulnerability (CVE-2026-17765) affects Google Chrome versions before 151.0.7922.72. It arises from an inappropriate implementation in the WebProtect component, which allows a remote attacker with control over the renderer process to leak cross-origin data by using a crafted HTML page. The issue is classified under CWE-346 (Origin Validation Error). The CVSS v3.1 base score is 4.3 (medium severity), indicating a network attack vector with low complexity and no privileges required but requiring user interaction. The impact is limited to confidentiality loss without integrity or availability impact. The vendor advisory URL is provided but does not explicitly state a remediation level or patch availability.

The vulnerability allows an attacker who has already compromised the renderer process to leak cross-origin data, potentially exposing sensitive information from other origins. There is no indication of integrity or availability impact. No known active exploitation has been reported.

The vendor advisory linked indicates a stable channel update for Chrome but does not explicitly confirm a patch or remediation level. Since the affected version is prior to 151.0.7922.72, updating to version 151.0.7922.72 or later is recommended to mitigate this vulnerability. Patch status is not yet confirmed explicitly in the advisory; users should verify the update details from the official Chrome release notes.