This vulnerability (CVE-2026-17833) affects Google Chrome versions before 151.0.7922.72. It is caused by an inappropriate implementation in the password handling feature, which allows a remote attacker to leak cross-origin data through a specially crafted HTML page. The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. The vulnerability is categorized under CWE-346 (Origin Validation Error). No official fix or remediation level is explicitly provided in the vendor advisory linked.

An attacker can remotely cause leakage of cross-origin data, potentially exposing sensitive information from other origins. The impact is limited to confidentiality loss; there is no impact on integrity or availability. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content, especially crafted HTML pages that might exploit this vulnerability.