CVE-2026-17895 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability resides within the DataTransfer implementation of Google Chrome, specifically affecting versions prior to 151.0.7922.72. The flaw represents an improper handling of cross-origin data transfer operations that could be exploited through social engineering techniques. Attackers could manipulate users into performing specific UI gestures on malicious web pages designed to trigger unintended data leakage from different origins. The vulnerability operates at the browser's user interface level where data transfer mechanisms interact with user actions, creating a pathway for unauthorized information disclosure between domains that should remain isolated.
The technical implementation flaw stems from inadequate validation of cross-origin boundaries during DataTransfer operations. When users perform specific UI gestures such as drag and drop interactions or clipboard manipulations, the browser's DataTransfer object fails to properly enforce same-origin policies. This allows malicious web pages to intercept or access data that should be restricted to its originating domain. The vulnerability specifically targets the interaction between user interface elements and the underlying data transfer mechanisms, creating a vector where user actions can be weaponized to bypass security restrictions.
From an operational perspective, this medium severity vulnerability poses significant risks in environments where users may encounter malicious websites through phishing campaigns or compromised web applications. The attack requires user interaction through specific UI gestures, making it less automated but still potentially dangerous in targeted scenarios. Successful exploitation could lead to information disclosure including sensitive data from other origins, session tokens, or personal information that should remain protected by browser security models. This type of vulnerability directly impacts the browser's ability to maintain isolation between different origins, which is fundamental to web security architecture.
The vulnerability aligns with CWE-200 (Information Exposure) and represents a specific implementation weakness in cross-origin data handling. From an ATT&CK framework perspective, this could be categorized under T1566 (Phishing) for the initial user interaction component and potentially T1071.004 (Application Layer Protocol: DNS) if the attack involves domain resolution manipulation. Organizations should prioritize updating to Chrome version 151.0.7922.72 or later to remediate this vulnerability. Additionally, browser security configurations should include monitoring for unusual UI gesture patterns and implementing strict content security policies. Regular security assessments of web applications and user education regarding suspicious website interactions can help mitigate the risk associated with this type of social engineering attack vector.