What is the CVSS score of CVE-2026-17703?

CVE-2026-17703 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17703?

Yes, a patch is available for CVE-2026-17703. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17703

EUVD-2026-50829 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-w9vw-56mm-f3qr

Apple Google Authentication Bypass Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery with mandatory active user interaction to visit a crafted page; no privileges needed; integrity-only impact as navigation bypass does not expose data or crash the browser.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:40 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

6.5 (None) 6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Craft malicious HTML page with navigation bypass payload

Delivery

Host on attacker-controlled site

Exploit

Lure iOS Chrome user via phishing or redirect

Install

User visits page in Chrome for iOS

Crafted content triggers insufficient policy enforcement

Execute

Navigation restrictions bypassed

Impact

User redirected to restricted or unauthorized resource

Recon

Craft malicious HTML page with navigation bypass payload

Delivery

Host on attacker-controlled site

Exploit

Lure iOS Chrome user via phishing or redirect

Install

User visits page in Chrome for iOS

Crafted content triggers insufficient policy enforcement

Execute

Navigation restrictions bypassed

Impact

User redirected to restricted or unauthorized resource

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome on iOS (not Safari, not Chrome on Android or desktop) with a version prior to 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures a network-reachable, low-complexity flaw requiring no authentication but mandating active user interaction (visiting a crafted page), with impact confined to integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page on an attacker-controlled domain and socially engineers a Chrome for iOS user into visiting it via phishing, malicious advertisement, or a redirect chain. Upon page load, the crafted content exploits the insufficient policy enforcement to bypass the browser's navigation restrictions, potentially redirecting the user to a restricted resource, circumventing enterprise URL filters, or bypassing authentication-gated navigation flows. …
Remediation	Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.