CVE-2026-17845

CVE-2026-17845 is a CSS parsing vulnerability in browser rendering engines that enables universal cross-site scripting (UXSS). Treat this as a critical severity issue regardless of its CVSS 6.1 rating—a UXSS flaw is a skeleton key that works against any origin the victim visits, not just the site hosting the vulnerable CSS parser. An attacker who chains this with phishing, waterholing, or a compromised browser extension can harvest credentials from banking sites, enterprise portals, and webmail providers without ever touching those target applications. Your Content Security Policy almost certainly does not cover this vector. Standard CSP testing harnesses and WAF validation suites lack CSS injection test cases entirely—they're tuned for JavaScript injection, not CSS-based script execution. Verify whether your policies account for malformed @import chains, CSS expression injection (IE compatibility contexts), and parser confusion techniques that conflate CSS tokens with HTML. If your CSP evaluation checklist doesn't include these, you have untested assumptions about directive coverage. The detection gap compounds the exposure window. Network logs showing credential exfiltration won't tell you whether UXSS was the entry point—the attack executes through normal browser pipelines with no unusual process behavior. Your threat hunting should include CSS injection artifacts specifically, not just generic XSS indicators. Patch cadence creates structural exposure. Browser vendors allocate engineering resources based on their own severity classifications, and MEDIUM-rated Chrome vulnerabilities receive lower priority and less aggressive auto-update enforcement. Combined with enterprise patch management cycles that typically run 30-90 days, this CVE likely has a 60-90 day window before reaching most endpoints. Browser isolation would neutralize this vector entirely, but requires capital expenditure and user experience trade-offs that organizations won't authorize for a MEDIUM-rated issue—precisely the misallocation the CVSS score enables. Audit your threat model: does it treat UXSS as categorically higher risk than site-bound XSS? If not, your compensating controls are built on a flawed risk assumption. The CVSS score doesn't just understate risk—it structurally discourages the forensic investment needed to determine whether this class of vulnerability is already in use in your environment.

Reviewed through automated stages and approved by a human before publication.