What is the CVSS score of CVE-2026-17724?

CVE-2026-17724 has a contested CVSS base score of 4.2 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17724?

Yes, a patch is available for CVE-2026-17724. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17724

EUVD-2026-50850 MEDIUM

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-rrqv-x75g-7225

Google Apple Race Condition Code Injection

Medium

Disputed · 4.2 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

UXSS by definition crosses origin boundaries warranting S:C; race condition timing and mandatory user visit retain AC:H and UI:R respectively.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 00:28 vuln.today

CVSS changed

Jul 30, 2026 - 22:37 NVD

4.2 (None) 4.2 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.2

DescriptionCVE.org

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.

Technical ContextAI

CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) underlies this flaw - a classic race condition where a timing window in Chrome's iOS rendering pipeline allows an attacker to manipulate shared state before it is properly validated or locked. The result is a UXSS condition, meaning the injected scripts can operate across multiple origins, effectively bypassing the browser's same-origin policy. On iOS, Apple's platform restrictions historically forced third-party browsers including Chrome to use WebKit as the underlying rendering engine rather than Blink/V8, making the iOS codebase distinct from desktop Chrome. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 151.0.7922.72. The race window likely exists in a navigation or frame-lifecycle event handler where the security context of a document is read and written non-atomically.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later, available through the Apple App Store. The patch is confirmed available per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations managing iOS devices through MDM, enforce a minimum Chrome version policy to ensure fleet-wide compliance. There are no documented vendor-provided workarounds; as a compensating control prior to patching, administrators could restrict access to untrusted web content by enforcing Safe Browsing policies or web content filtering, though this introduces browsing friction and does not eliminate the attack surface. Users unable to update immediately should exercise caution when opening links from untrusted sources in Chrome for iOS.