What is the CVSS score of CVE-2026-17728?

CVE-2026-17728 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17728?

Yes, a patch is available for CVE-2026-17728. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17728

EUVD-2026-50677 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 Chrome

GHSA-jwcc-m68f-c33r

XSS Google

Medium

Disputed · 5.4 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

S:C chosen over vendor's S:U because UXSS by definition crosses origin boundaries, affecting security scope beyond the loaded page; C/I remain L given described impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) manifests here as a UXSS variant - a browser-level XSS class that exploits implementation flaws in the browser's extension subsystem rather than a web application. Unlike conventional reflected or stored XSS, UXSS abuses extension APIs or privileged content-script context to inject scripts that can potentially execute across origin boundaries, undermining the Same Origin Policy. The affected product is Google Chrome itself, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions below 151.0.7922.72. The Chromium bug tracker issue 461167648 is referenced but is likely access-restricted, limiting independent technical analysis of the precise code path involved.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the vendor-confirmed patched release documented at the Chrome Releases stable channel advisory (chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's automatic update mechanism will deliver this update to most users; verify the installed version via chrome://settings/help. If immediate patching is not feasible, mitigations should focus on restricting extension permissions - particularly those with broad host access or content-script injection capabilities - via enterprise policy (ExtensionSettings) to reduce the attack surface, though this may impact legitimate extension functionality. For high-risk environments, consider enabling Enhanced Safe Browsing and enforcing navigation controls to block access to untrusted or unknown pages. There are no known effective workarounds that fully substitute for patching.