CVE-2026-17897 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability under discussion represents a critical cross-origin data leakage issue within the Object Request Broker implementation of Google Chrome browsers prior to version 151.0.7922.72. This flaw resides in the ORB component which serves as a communication framework for handling object requests across different domains and contexts. The improper implementation creates an avenue for remote attackers to exploit cross-origin resource sharing mechanisms in ways that were not properly constrained or validated.
The technical nature of this vulnerability stems from insufficient validation and sanitization within the ORB processing pipeline where objects are serialized and transmitted between different security contexts. Attackers can craft malicious HTML pages that leverage specific object request patterns to bypass normal cross-origin restrictions. These crafted pages exploit the gap in the ORB implementation where object references are not properly isolated between different origins, allowing unauthorized data access across domain boundaries.
From an operational impact perspective, this vulnerability enables attackers to perform cross-origin data exfiltration without requiring user interaction or explicit consent from the target system. The medium severity classification reflects the potential for significant information disclosure when combined with other attack vectors or when targeting sensitive applications. The flaw affects all users of affected Chrome versions and requires no privileged access or specialized tools for exploitation, making it particularly dangerous in real-world scenarios.
The vulnerability aligns with CWE-200, which addresses improper information exposure, and maps to ATT&CK technique T1071.004 for application layer protocol manipulation. This flaw specifically relates to the improper handling of cross-origin object requests where security boundaries are not properly enforced during serialization and deserialization processes. The issue demonstrates a failure in maintaining proper isolation between different security contexts within the browser's object request processing framework.
Organizations should immediately update to Chrome version 151.0.7922.72 or later to remediate this vulnerability. Additional mitigations include implementing strict content security policies, enabling sandboxing features, and monitoring for suspicious cross-origin requests in network traffic. Security teams should also consider deploying web application firewalls that can detect and block malicious HTML page patterns associated with this specific exploitation technique. Regular browser updates and security awareness training remain essential defensive measures against similar vulnerabilities in the evolving threat landscape.
The incident highlights the critical importance of proper object request broker implementation in modern browsers, particularly when handling cross-origin communications. It demonstrates how seemingly minor implementation gaps in core browser components can result in significant security implications. Organizations must maintain vigilance in monitoring for similar vulnerabilities and ensure comprehensive testing of security controls across all browser versions and implementations.