CVE-2026-17985

This CVE exposes a site isolation bypass in Chrome's SpeechSynthesis API—the browser failed to enforce its own site isolation boundary at a speech synthesis API boundary. The vulnerability received CVSS 6.5, but Chromium's own severity rating is "Low" and EPSS shows only 0.2% probability of exploitation in 30 days. These aren't contradictory; they reflect different analytical lenses. CVSS measures structural impact without modeling browser permission models. EPSS captures empirical likelihood—which is negligible here because exploiting this requires a specific context: the target must have a page using SpeechSynthesis open, the attacker must serve a crafted page, and the Speech API requires user gesture or permission to function. The exploit chain is longer than CVSS accounts for. The fix was almost certainly a single missing check at an API boundary—some policy enforcement existed (likely origin and secure context checks), but the site isolation boundary wasn't included. That simplicity is the most troubling part: this wasn't a cryptographic failure or timing attack. It was a missing guard at an integration point, meaning the Speech API was shipped without ever being tested against site isolation enforcement. The practical implication: treat this as a class warning, not just an individual bug. Other browser APIs that handle sensitive capabilities (camera, microphone, storage) likely have the same gap—they were added incrementally, each team assuming site isolation was a platform guarantee rather than an API responsibility. If you're defending Chrome deployments, prioritize identifying any internal or third-party web applications using the Speech API and monitor for similar patches in related APIs. The low EPSS score suggests no urgent active exploitation, but the vulnerability class this represents warrants systematic auditing of your browser API exposure surface.

Reviewed through automated stages and approved by a human before publication.