CVE-2026-2317: Google Chrome · Inappropriate Implementation
Affects Google ChromeSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium : upgrade to 145.0.7632.45 when convenient.
Data as of 26 Oct 2026, 09:16 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 145.0.7632.45
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Google Chrome to 145.0.7632.45.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GoogleChrome | Affected
| Fixed in
|
AI-suggested
To mitigate CVE-2026-2317, organizations and users should promptly update Google Chrome to version 145.0.7632.45 or later, where the vulnerability has been addressed. If you cannot patch yet, users should exercise caution when visiting untrusted or suspicious websites, as exploitation requires user interaction. Network-level protections such as web filtering and intrusion prevention systems can help block access to malicious sites attempting to exploit this vulnerability. Organizations should also consider implementing Content Security Policy (CSP) headers to restrict the execution of untrusted scripts and reduce the risk of cross-origin data leakage. Regularly auditing browser extensions and disabling unnecessary ones can minimize attack surface. Security teams should monitor threat intelligence feeds for any emerging exploit attempts and be prepared to respond accordingly. Finally, educating users about the risks of interacting with unknown web content can reduce the likelihood of successful exploitation.
Description
Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)