CVE-2026-17975
Summary
by MITRE • 07/30/2026
Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents an information disclosure issue within the Input Method Editor functionality of Google Chrome on macOS systems. The flaw stems from inadequate memory management during the processing of input method events, specifically affecting how Chrome handles IME operations in its rendering engine. The vulnerability is classified as low severity by Chromium security standards but remains significant due to its potential to expose sensitive process memory contents to remote attackers.
The technical implementation flaw occurs when Chrome's IME subsystem processes crafted HTML content that triggers specific memory access patterns. During normal operation, the Input Method Editor manages text input for languages requiring complex character composition through multiple keystrokes or gestures. When malicious HTML pages attempt to manipulate these processes through carefully constructed inputs, the system fails to properly isolate or sanitize memory regions containing potentially sensitive data. This improper handling allows memory addresses and contents to be accessed or exposed through the browser's rendering mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure, as attackers could potentially extract sensitive data from process memory including user credentials, session tokens, or other confidential information. The attack vector requires remote code execution through a web page, making it particularly concerning for users who browse untrusted websites or receive malicious emails with embedded content. While the severity is rated as low, the nature of information disclosure vulnerabilities often increases in risk when combined with other exploitation techniques or when targeting specific user populations.
Attackers could leverage this vulnerability through social engineering campaigns that direct victims to visit compromised websites containing the malicious HTML payload. The exploit would function by triggering the IME processing path with crafted inputs that cause Chrome to leak memory contents through various communication channels within the browser's architecture. This type of vulnerability aligns with CWE-200 (Information Exposure) and potentially maps to ATT&CK technique T1552.001 (Credentials In Files) when sensitive data is extracted from process memory.
The recommended mitigation strategy involves updating Chrome to version 151.0.7922.72 or later, where the IME handling logic has been properly implemented with appropriate memory isolation and access controls. Organizations should also implement network-level protections such as content filtering systems that can detect and block suspicious HTML content targeting known browser vulnerabilities. Additionally, users should maintain regular browser updates and avoid visiting untrusted websites that may host malicious content designed to exploit such information disclosure flaws in web browsers.