Security Resilience

CVE-2026-17696

Google Chrome ≤ 151.0.7922.72

Published
30 July 2026
Modified
31 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0026 16th percentile
Risk Priority 37 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-17696 is a medium-severity Improper Protection of Physical Side Channels (CWE-1300) vulnerability in Google Chrome. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cached Domain Credentials (T1003.005); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to PE-19 (Information Leakage) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-1300

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1012 Query Registry Discovery
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
attack.mitre.org →
T1016.001 Internet Connection Discovery Discovery
Adversaries may check for Internet connectivity on compromised systems.
attack.mitre.org →
T1021.001 Remote Desktop Protocol Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
attack.mitre.org →
T1021.002 SMB/Windows Admin Shares Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-17859Same product: Google Chrome
CVE-2026-13922Same product: Google Chrome
CVE-2026-17800Same product: Google Chrome
CVE-2026-14085Same product: Google Chrome
CVE-2026-13790Same product: Google Chrome
CVE-2026-17978Same product: Google Chrome
CVE-2026-17914Same product: Google Chrome
CVE-2026-17907Same product: Google Chrome
CVE-2026-17760Same product: Google Chrome
CVE-2026-13935Same product: Google Chrome

Affected Assets

google
chrome
≤ 151.0.7922.72

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

PE-19 Information Leakage partial match

Directly requires protection against electromagnetic emanation leakage, which stops one class of the physical side-channel exposures described in CWE-1300.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-06 partial match
blocks

Limiting physical access reduces opportunity for side-channel observation but does not address emission-protection mechanisms inside the device.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
removes
A.8.29 Security testing in development and acceptance partial match
finds

Security testing can include side-channel analysis to verify protections.

A.8.8 Management of technical vulnerabilities partial match
removes
A.8.9 Configuration management partial match
removes

References