This vulnerability (CVE-2026-17878) affects Google Chrome browsers before version 151.0.7922.72. It stems from an inappropriate implementation in CSS handling that enables remote attackers to perform UXSS attacks by injecting arbitrary scripts or HTML through a crafted HTML page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There are no known exploits in the wild. The vendor advisory linked confirms the fix is included in Chrome 151.0.7922.72.

Successful exploitation allows remote attackers to inject arbitrary scripts or HTML into the browser context, leading to UXSS. This can result in limited confidentiality and integrity impacts within the affected browser session. There is no impact on availability. No known active exploitation has been reported.

Users should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.