What is the CVSS score of CVE-2026-17698?

CVE-2026-17698 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17698?

Google Chrome for Android contains a high-severity vulnerability (CVE-2026-17698) that exposes sensitive user data across websites through malicious pages.. A patch is available.

How to fix or mitigate CVE-2026-17698?

Within 24 hours, identify Chrome on Android deployment across your organization, including corporate-managed and BYOD devices. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all managed Android devices via MDM; simultaneously send guidance to BYOD users to update Chrome from the Google Play Store with communication emphasizing the data exposure risk. Within 30 days, verify 100% of managed devices have updated to version 151.0.7922.72 or later through MDM telemetry and document deployment for compliance records.

Google Chrome CVE-2026-17698

EUVD-2026-50824 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-4v89-64wc-c622

Information Disclosure Google

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered crafted page with low complexity and no privileges, but the victim must load the malicious page so UI:R; impact is cross-origin data leak only, hence C:H/I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:36 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Cross-origin data disclosure in Google Chrome for Android before 151.0.7922.72 lets a remote attacker leak data from other origins by luring a victim to a crafted HTML page that abuses insufficient input validation in the browser UI. Rated High by Chromium and CVSS 7.5 (confidentiality-only). There is no public exploit identified at time of analysis, and EPSS is low at 0.18%, though SSVC flags the attack as automatable with partial technical impact.

Technical ContextAI

The flaw resides in Chrome's Android UI layer, which fails to sufficiently validate untrusted input, corresponding to CWE-20 (Improper Input Validation). Because the browser is responsible for enforcing the same-origin policy, a validation gap in UI-handled input can let a malicious page observe or infer content belonging to a different origin, breaking cross-origin isolation. The affected component is Google's Chromium-based browser (CPE cpe:2.3:a:google:chrome), specifically the Android build, where the rendering and UI presentation of untrusted HTML is the attack surface.

RemediationAI

Update Google Chrome on Android to 151.0.7922.72 or later - Vendor-released patch: 151.0.7922.72 (Patch available per vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Most Android installs update automatically through the Google Play Store, so ensure Play auto-updates are enabled and force an update via chrome://settings/help or the Play Store listing; in managed fleets, push the minimum-version policy through your MDM/EMM. Until the update lands, reduce exposure by avoiding untrusted links and enabling Enhanced Safe Browsing, which adds real-time protection against malicious pages (trade-off: sends more browsing telemetry to Google); there is no server-side toggle to disable since the flaw is in the client browser itself.