CVE-2026-17932

This is a use-after-free in Chrome's DataTransfer component (clipboard and drag-drop handling) on Windows, triggerable through crafted HTML. The vulnerability permits information disclosure from browser process memory — not code execution. The Chromium team rated this 'Low,' which is the most defensible assessment. The CVSS 5.5 (Medium) overstates actual risk for three reasons: the 'local attacker' label is misleading since the trigger is a single HTML page load (phishing, malvertising), the exploitation path caps at information disclosure rather than RCE, and the EPSS score of 0.00106 reflects near-zero probability of active exploitation. Defenders should note two non-obvious risks. First, browser process memory isn't abstract data — it contains OAuth tokens, session cookies, cached credentials, and extension state. Treating this as 'just information disclosure' underestimates its value to attackers; historically, info-leak UAFs in browsers serve as stage-one primitives in multi-exploit chains. Second, DataTransfer is legacy infrastructure — clipboard handling is feature-complete and no longer actively hardened, making it a sediment layer where similar decay likely persists elsewhere. Prioritize patching based on the EPSS score rather than CVSS severity. For most organizations, this does not warrant emergency patching cycles. However, maintain awareness: if this class of vulnerability appears in active exploit kits, the prioritization shifts immediately. The 'Low' vendor rating reflects Chromium's understanding of the specific exploitation chain — trust it over the generic CVSS vector.

Reviewed through automated stages and approved by a human before publication.