What is the CVSS score of CVE-2026-17679?

CVE-2026-17679 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17679?

Yes, a patch is available for CVE-2026-17679. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17679

EUVD-2026-50805 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-hx6m-53hj-vjmc

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Renderer pre-compromise is a non-trivial, explicit prerequisite justifying AC:H; confidentiality impact only, no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.8 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:55 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.

Technical ContextAI

The vulnerability resides in Chrome's Print Preview subsystem, affecting all versions across all platforms (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The root cause is CWE-20 (Improper Input Validation): the Print Preview component fails to sufficiently validate untrusted input originating from a compromised renderer process, allowing that compromised renderer to access and leak data governed by the Same-Origin Policy. Chrome's multi-process security architecture is designed to sandbox renderer processes, with the browser process acting as a privilege boundary enforcer; this flaw represents a partial bypass of that cross-origin isolation when Print Preview handles renderer-supplied content, enabling leakage of data (cookies, tokens, page content) from origins other than the attacker-controlled page.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, available via Chrome's built-in auto-update mechanism or directly from the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This patch addresses the insufficient input validation in the Print Preview component. For enterprise environments unable to immediately deploy the update, the PrintingEnabled Chrome policy can be set to false to disable Print Preview entirely, eliminating this attack surface at the cost of all in-browser printing capability. No other confirmed workaround fully mitigates the vulnerability without patching. Organizations relying on extended support channels should verify whether their managed Chrome version includes this fix independently.