What is the CVSS score of CVE-2026-17690?

CVE-2026-17690 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17690?

Yes, a patch is available for CVE-2026-17690. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17690

EUVD-2026-50816 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-8pgq-9x47-q4gm

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Attack delivery is via a crafted HTML page (network vector); user must interact (UI:R); confidentiality-only impact from cross-origin data leak; no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.8 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:39 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.

Technical ContextAI

The vulnerability resides in Google Chrome's PDF rendering subsystem on the Android platform, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root cause is CWE-20 (Improper Input Validation), meaning Chrome fails to adequately validate untrusted content supplied through PDF processing when that content is embedded or triggered via an HTML page. The cross-origin data leak implies the PDF component does not correctly enforce the Same-Origin Policy or equivalent isolation boundaries under certain input conditions, allowing data from origins other than the attacker's to be read. This is an Android-specific code path, suggesting the vulnerability may relate to Chrome's Android PDF viewer integration rather than the shared Chromium renderer used on desktop platforms.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 for Android, detailed in the stable channel update advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Update Chrome on Android to version 151.0.7922.72 or later via the Google Play Store. As a compensating control prior to patching, users can avoid opening PDF content directly in Chrome on Android - using a dedicated offline PDF reader application eliminates the vulnerable code path. Disabling JavaScript or using Chrome's site isolation flags may reduce cross-origin leakage surface but carries significant compatibility trade-offs with modern web applications and is not a reliable substitute for the patch. Enterprise administrators managing Android fleets should prioritize the update through their MDM solution.