CVE-2026-17858 in Chrome
Summary
by MITRE • 07/30/2026
Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents an uninitialized memory access issue within the WebNN API implementation in Google Chrome running on Windows systems. The flaw occurs when the WebNN API processes certain JavaScript objects without proper initialization, creating a potential pathway for information disclosure. The vulnerability is classified as medium severity by Chromium security standards and specifically affects Chrome versions prior to 151.0.7922.72 on Windows platforms.
The technical nature of this vulnerability stems from improper memory management within the WebNN API's JavaScript object handling mechanisms. When a crafted HTML page attempts to interact with WebNN APIs, it can trigger conditions where uninitialized memory segments are accessed and potentially exposed through cross-origin data leakage. This type of vulnerability falls under CWE-457: Use of Uninitialized Variable, which is a well-documented weakness in software security practices.
The operational impact of this vulnerability allows remote attackers to exploit cross-origin information disclosure through carefully constructed web pages that manipulate the WebNN API behavior. Attackers can craft malicious HTML content that, when loaded in a victim's browser, causes the uninitialized memory access pattern to occur, potentially exposing sensitive data from other origins or domains. This cross-origin data leakage represents a significant privacy and security concern as it enables unauthorized information retrieval across different web contexts.
The attack surface for this vulnerability is primarily through web-based exploitation where a malicious website can load a crafted HTML page containing JavaScript that interacts with the WebNN API in unexpected ways. The vulnerability requires no user interaction beyond visiting the malicious webpage, making it particularly concerning for automated exploitation scenarios. This aligns with ATT&CK technique T1566.001: Phishing: Spearphishing Attachment, where the initial compromise occurs through web-based delivery mechanisms.
Mitigation strategies should focus on updating Chrome to version 151.0.7922.72 or later, which contains the necessary patches addressing the uninitialized memory access issue in WebNN API implementation. Organizations should also implement network-level protections such as content security policies that restrict access to potentially vulnerable APIs and monitor for unusual patterns of cross-origin data requests. Browser security teams recommend enabling automatic updates where possible to ensure timely patch deployment against known vulnerabilities.
This vulnerability demonstrates the importance of proper initialization checking within complex JavaScript APIs, particularly those that interface with low-level system resources or provide access to sensitive data processing capabilities. The WebNN API's implementation should include comprehensive validation mechanisms to ensure all objects are properly initialized before being accessed, preventing potential information disclosure through uninitialized memory access patterns that could be leveraged by remote attackers for cross-origin data leakage.