CVE-2026-17720 describes an insufficient policy enforcement vulnerability in the password component of Google Chrome versions before 151.0.7922.72. An attacker who has already compromised the renderer process can exploit this vulnerability to leak data across origins by using a specially crafted HTML page. This cross-origin data leakage could expose sensitive information managed by the browser's password system. The vulnerability is rated high severity by Chromium but lacks a CVSS score and explicit patch details in the provided information.

The vulnerability allows a remote attacker with control over the renderer process to bypass policy restrictions and leak cross-origin data. This could lead to unauthorized disclosure of sensitive password-related information stored or handled by the browser. No evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 151.0.7922.72, updating to version 151.0.7922.72 or later is likely recommended once confirmed by the vendor. Monitor official Google Chrome security advisories for updates and apply patches promptly when available.