This vulnerability (CVE-2026-17829) affects Google Chrome versions before 151.0.7922.72. It stems from insufficient policy enforcement in the Passwords feature, enabling a remote attacker to leak cross-origin data by tricking a user into visiting a malicious HTML page. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited confidentiality impact. The vulnerability is categorized under CWE-346 (Insufficient Authorization). The vendor advisory link is provided but does not explicitly state patch availability or remediation details.

The vulnerability allows an attacker to leak cross-origin data, which compromises confidentiality to a limited degree. There is no impact on data integrity or system availability. Exploitation requires user interaction and can be performed remotely over the network. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official confirmation, users should update to version 151.0.7922.72 or later once available. No additional mitigation steps are specified by the vendor.