What is the CVSS score of CVE-2026-17693?

CVE-2026-17693 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17693?

Yes, a patch is available for CVE-2026-17693. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17693

EUVD-2026-50819 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-9xqg-8hc3-vfpq

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L, PR:N); victim must visit attacker URL (UI:R); limited to partial cross-origin data read with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:40 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.

Technical ContextAI

The vulnerability resides in Google Chrome's FileSystem API implementation - either the legacy File System API or the modern File System Access API - which allows web content to interact with origin-scoped storage. CWE-346 (Origin Validation Error) indicates that the enforcement of same-origin policy within the FileSystem subsystem is incomplete, permitting a crafted page to read or infer data belonging to a different origin. Same-origin policy is a foundational browser security boundary; failures here undermine the isolation guarantees that prevent cross-site data theft. The affected product is Google Chrome across all versions prior to 151.0.7922.72 on desktop platforms, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The Chromium bug tracker entry (issues.chromium.org/issues/517448723) contains additional technical detail under restricted access.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later via the built-in auto-update mechanism or the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Auto-update is enabled by default for most Chrome installations and will apply the fix without manual intervention; enterprise deployments using Google Update or third-party patch management should verify rollout completion. If immediate patching is not possible, organizations can apply Chrome enterprise policies to restrict navigation to untrusted external websites, reducing exposure to attacker-hosted crafted pages - this limits functionality and may affect productivity. Disabling the FileSystem API via enterprise policy (if supported and not business-critical) would eliminate the attack surface entirely but would break any web applications relying on origin-private file storage. No patch version other than 151.0.7922.72 is independently confirmed at time of analysis.