What is the CVSS score of CVE-2026-17683?

CVE-2026-17683 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17683?

Yes, a patch is available for CVE-2026-17683. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17683

EUVD-2026-50809 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-3wgm-hxjc-v3w2

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:N and PR:N because only a crafted web page visit is required; UI:R for mandatory victim navigation; C:H for renderer process memory exposure; S:U confirms no sandbox escape; I:N and A:N as no write or denial-of-service impact exists.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:42 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer that translates OpenGL ES API calls to platform-native rendering APIs (DirectX on Windows, Metal on macOS, Vulkan where supported). An inappropriate implementation within ANGLE - classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - causes the subsystem to improperly handle memory in a way that allows contents of the renderer process to be read by attacker-controlled web content. The vulnerability is scoped to the renderer process (S:U in CVSS, no sandbox escape), limiting but not eliminating the sensitivity of potentially disclosed data. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, per the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically, but users must fully restart the browser after the update is downloaded for it to take effect - verify the installed version under chrome://settings/help. For environments where immediate restart is not feasible, restrict navigation to untrusted or external websites as a temporary compensating control; this reduces exposure but does not eliminate it if trusted sites are compromised. Enterprise deployments using Chrome via managed policies should push the update through their endpoint management platform and enforce browser restart via policy to close the remediation gap.