What is the CVSS score of CVE-2026-17683?

CVE-2026-17683 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17683?

Yes, a patch is available for CVE-2026-17683. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17683

EUVD-2026-50809 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-3wgm-hxjc-v3w2

Google Information Disclosure Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:N and PR:N because only a crafted web page visit is required; UI:R for mandatory victim navigation; C:H for renderer process memory exposure; S:U confirms no sandbox escape; I:N and A:N as no write or denial-of-service impact exists.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:42 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML/WebGL page

Delivery

Victim clicks link and opens page in Chrome < 151.0.7922.72

Exploit

Crafted content triggers ANGLE graphics implementation flaw

Execution

Renderer process memory contents leaked to attacker-controlled script

Impact

Sensitive in-process data (tokens, page content) exfiltrated

Access

Attacker crafts malicious HTML/WebGL page

Delivery

Victim clicks link and opens page in Chrome < 151.0.7922.72

Exploit

Crafted content triggers ANGLE graphics implementation flaw

Execution

Renderer process memory contents leaked to attacker-controlled script

Impact

Sensitive in-process data (tokens, page content) exfiltrated

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome in any version prior to 151.0.7922.72 on a supported desktop platform (Windows, macOS, or Linux). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 is driven by AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact, tempered by a mandatory user interaction requirement and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing JavaScript or WebGL content that triggers the ANGLE implementation flaw during graphics processing. A victim using Chrome prior to 151.0.7922.72 is lured to the page - via phishing email, malicious advertisement, or compromised third-party site - causing the browser's ANGLE subsystem to leak renderer process memory contents back to the attacker's page. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later, per the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.