What is the CVSS score of CVE-2026-17668?

CVE-2026-17668 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17668?

Yes, a patch is available for CVE-2026-17668. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17668

EUVD-2026-50794 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-jmrw-c58m-5h7j

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page with no privileges; UI:R because victim must load the page; confidentiality-only impact, no integrity or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:59 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics abstraction layer that translates OpenGL ES API calls into platform-native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan where supported). CWE-457 (Use of Uninitialized Variable) indicates that a memory region in ANGLE's processing pipeline is consumed before being fully initialized, meaning it may contain stale or residual data from prior allocations - potentially including data belonging to a different web origin. This class of bug in a graphics subsystem can enable speculative or direct cross-origin information disclosure through WebGL or canvas rendering operations. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. The stable channel update announcement is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this to most users automatically; administrators managing enterprise fleets should verify that update policies are not blocking the rollout. If patching is temporarily delayed, a compensating control is to enforce browser isolation policies (e.g., Site Isolation is already enabled by default in modern Chrome builds) and restrict access to untrusted web content via proxy filtering or managed browser profiles - though neither eliminates the underlying risk. Disabling WebGL via enterprise policy (RendererCodeIntegrity or WebGL disabled via flag) would reduce the attack surface at the cost of breaking graphics-heavy web applications.