CVE-2026-17764 describes an inappropriate implementation in the Federated Credential Management (FedCM) feature of Google Chrome that allows a remote attacker to bypass the same origin policy via a crafted HTML page. This vulnerability affects Chrome versions prior to 151.0.7922.72. The issue is categorized under CWE-693 (Protection Mechanism Failure) and has a CVSS v3.1 base score of 6.5, indicating a moderate severity. The attack vector is network-based with low attack complexity, no privileges required, and requires user interaction. The impact is limited to integrity, with no confidentiality or availability impact. There is no vendor advisory or patch link provided in the data, so patch status is not confirmed.

The vulnerability allows a remote attacker to bypass the same origin policy, potentially enabling unauthorized modification of data or actions within the context of a trusted origin. The CVSS vector indicates no confidentiality or availability impact, but integrity is impacted. This could allow attackers to interfere with web application logic or data integrity under certain conditions. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 151.0.7922.72, updating Google Chrome to version 151.0.7922.72 or later is recommended once official patches are confirmed. Monitor official Chromium or Google Chrome security advisories for updates and apply any available fixes promptly.