What is the CVSS score of CVE-2026-17730?

CVE-2026-17730 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17730?

Yes, a patch is available for CVE-2026-17730. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17730

EUVD-2026-50681 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-07-30 Chrome

GHSA-fwgj-pjpg-r36c

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered with no auth required; UI:R captures mandatory user gestures; C:L reflects limited cross-origin data leakage with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:42 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.

Technical ContextAI

Chrome's Autofill subsystem populates form fields with locally stored user data (addresses, payment cards, credentials). CWE-1300 (Improper Protection of Physical Side Channels) here manifests as a logical/behavioral side-channel: the attacker's page observes differences in browser state, timing, or rendering triggered by Autofill's interaction with form elements to infer information that the Same-Origin Policy should isolate. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all desktop Chrome builds prior to 151.0.7922.72. The Chromium issue tracker reference (issues.chromium.org/issues/40057032) may provide additional technical detail on the specific Autofill signal being leaked, though the public description does not disclose the precise mechanism.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the patched release per the Chrome Releases stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this fix to most users automatically. As a compensating control where immediate patching is not feasible, disabling Chrome's Autofill features via Settings > Autofill and Passwords eliminates the attack surface entirely; the trade-off is the loss of saved address, payment card, and credential auto-population. Enterprise environments can enforce Autofill disablement via Chrome Group Policy or Google Admin Console using the AutofillAddressEnabled and AutofillCreditCardEnabled policies set to false. Restricting users from visiting untrusted or unvetted web pages reduces exposure but is not a complete mitigation.