The vulnerability CVE-2026-17905 affects Google Chrome versions before 151.0.7922.72. It arises from an inappropriate implementation in the SurfaceCapture feature, which can be exploited by a remote attacker to leak cross-origin data through a specially crafted HTML page. The vulnerability is categorized under CWE-346 (Origin Validation Error). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to confidentiality. There is no explicit remediation level or patch link provided, but the affected versions are clearly stated as those before 151.0.7922.72. The vendor advisory URL is provided but does not explicitly confirm patch status in the input data.

A remote attacker can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins. The impact is limited to confidentiality and does not affect integrity or availability. The attack requires user interaction and can be performed remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should upgrade to version 151.0.7922.72 or later once confirmed. Until then, exercise caution with untrusted web content that could exploit this vulnerability.