CVE-2026-17853

Analyzed Analyzed - Analysis Complete

Chrome DevTools Improper Script Injection Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17853

EUVD

EUVD-2026-50602

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is in Google Chrome's DevTools. It allows a remote attacker who has already compromised the renderer process to inject scripts or HTML into a privileged page by using a specially crafted HTML page. This is due to an inappropriate implementation in DevTools.

Detection Guidance

This vulnerability is specific to Google Chrome's DevTools and requires detecting compromised renderer processes. Check Chrome version with chrome://version/ and ensure it is 151.0.7922.72 or later. Monitor for unusual renderer process behavior or injected scripts in privileged pages.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious scripts or display harmful content in a privileged page. This might lead to unauthorized actions, data theft, or further compromise of the user's system or data.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it involves a renderer process compromise in Google Chrome. However, if exploited, it could lead to unauthorized script or HTML injection, potentially exposing sensitive user data. This may indirectly affect compliance if such data exposure violates regulatory requirements for data protection and privacy.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the vulnerability. Disable unnecessary browser extensions and avoid visiting untrusted websites until the update is applied.

Hi! I’m here to help you understand CVE-2026-17853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70