CVE-2026-17895 describes an inappropriate implementation in the DataTransfer component of Google Chrome versions before 151.0.7922.72. This flaw enables a remote attacker to leak cross-origin data if a user is tricked into performing certain UI gestures on a maliciously crafted HTML page. The vulnerability is categorized with medium severity by Chromium security. There is no CVSS score or detailed vendor advisory information available in the provided data. No exploits are currently known in the wild.

The vulnerability allows unauthorized cross-origin data leakage, which can compromise user privacy and data confidentiality. The attack requires user interaction through specific UI gestures, limiting the ease of exploitation. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 151.0.7922.72 or later once available to remediate this issue.