This vulnerability (CVE-2026-17797) arises from an inappropriate implementation in CSS handling in Google Chrome versions prior to 151.0.7922.72. It allows remote attackers to perform UXSS attacks by injecting arbitrary scripts or HTML via crafted HTML pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impacts and no availability impact.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary scripts or inject HTML content in the context of the victim's browser, potentially leading to information disclosure or manipulation of web content. The impact is limited to confidentiality and integrity with no direct availability impact. No known active exploitation has been reported.

Google has released an update in Chrome version 151.0.7922.72 that addresses this vulnerability. Users and administrators should update to this version or later to mitigate the risk. Since this is a client-side vulnerability, applying the official update is the recommended remediation. No additional vendor advisories indicate alternative mitigations or that no action is required.