Google Chrome versions before 151.0.7922.72 contain a vulnerability (CVE-2026-17674) caused by an inappropriate implementation in HTML that enables a remote attacker to bypass the browser's content security policy (CSP) through a specially crafted HTML page. This flaw is categorized under CWE-693 (Protection Mechanism Failure). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a moderate level of risk with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can bypass the content security policy in affected versions of Google Chrome, potentially allowing unauthorized script execution or content injection that violates the intended security restrictions. This can lead to integrity violations within the browser context. There is no direct confidentiality or availability impact reported.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client software vulnerability, applying the official update from Google is the recommended mitigation. No other vendor advisory or patch links were provided, so check Google's official channels for confirmation and updates.