CVE-2026-17781 is a vulnerability in the implementation of extensions in Google Chrome versions prior to 151.0.7922.72. It enables an attacker, who persuades a user to install a crafted malicious extension, to leak cross-origin data. This occurs due to improper handling within the extension framework, potentially exposing data that should be isolated by same-origin policies. The vulnerability is classified as medium severity by Chromium security. There is no CVSS score provided, and no known exploits have been observed in the wild. The vendor has not provided explicit patch or remediation details in the input data, but the version boundary indicates a fix was introduced in 151.0.7922.72.

Successful exploitation allows a malicious extension to bypass cross-origin data protections, leading to potential leakage of sensitive information from other origins within the browser context. This compromises user data confidentiality but requires user interaction to install the malicious extension.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later, where this vulnerability is fixed. Since this is a client-side vulnerability requiring user installation of a malicious extension, avoiding installation of untrusted extensions also mitigates risk. Patch status is inferred from the version boundary; check official Google Chrome advisories for confirmation and further guidance.