CVE-2026-17748 is a medium severity vulnerability in Google Chrome's Extensions implementation before version 151.0.7922.72. It allows a remote attacker, who has already compromised the renderer process, to bypass site isolation protections by using a specially crafted HTML page. This bypass could lead to increased risk of unauthorized interactions or data exposure within the browser's extension environment. The vulnerability is categorized under CWE-346 (Origin Validation Error).

The vulnerability enables bypassing of site isolation, which is a security feature designed to separate different web origins into different processes. By bypassing this, an attacker with control over the renderer process could potentially interfere with or access data across site boundaries within the browser extensions context. However, there is no direct confidentiality impact reported, but integrity is impacted. Availability is not affected. No known exploits in the wild have been reported.

A fix for this vulnerability is available in Google Chrome version 151.0.7922.72 and later. Users and administrators should update to this version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official browser update. Patch status is confirmed by the version information in the description. No additional mitigation steps are indicated.