What is the CVSS score of CVE-2026-17703?

CVE-2026-17703 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17703?

Yes, a patch is available for CVE-2026-17703. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17703

EUVD-2026-50829 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-w9vw-56mm-f3qr

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery with mandatory active user interaction to visit a crafted page; no privileges needed; integrity-only impact as navigation bypass does not expose data or crash the browser.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:40 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

6.5 (None) 6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: security controls that should be enforced at the policy or platform layer are delegated to client-side logic and can be subverted. In Chrome for iOS, navigation restrictions govern behaviors such as cross-origin navigation, content security policies, and enterprise or MDM-applied URL filtering. The iOS-specific Chrome code path fails to adequately enforce these policies, allowing a crafted HTML page to trigger navigation to otherwise restricted destinations. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions below 151.0.7922.72 on iOS. The tags 'Apple, Google, Authentication Bypass' indicate the bypass may also circumvent authentication-gated navigation flows on iOS.

RemediationAI

Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Users should apply the update via the Apple App Store, as iOS browser updates require App Store delivery. As a short-term compensating control prior to patching, restrict browsing to trusted, known-good sites in Chrome for iOS, though this substantially limits usability. Enterprise administrators using MDM platforms (e.g., Jamf, Microsoft Intune) can enforce minimum browser version policies to detect and flag unpatched iOS Chrome installations on managed devices, reducing organizational exposure.