What is the CVSS score of CVE-2026-17731?

CVE-2026-17731 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17731?

Yes, a patch is available for CVE-2026-17731. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-17731

EUVD-2026-50682 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-g3r4-phhf-px98

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Remote delivery via crafted page, no auth needed, victim must visit (UI:R); impact is limited cross-origin data leak only (C:L), no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:50 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.

Technical ContextAI

CWE-346 (Origin Validation Error) is the root cause class - the application accepts data or exposes functionality without properly verifying that the requesting context shares the same origin. Chrome's Autofill on Android interacts with form fields across page contexts and, when improperly implemented, can surface autofill-populated data to scripts or frames from a different origin, violating the Same-Origin Policy. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers Google Chrome broadly, but the CVE description and the EUVD affected-versions entry explicitly scope the flaw to Chrome on Android prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/463551850) is not publicly accessible at time of analysis, so the precise Autofill code path is not independently verifiable from open sources.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later. The vendor-released patch is documented in the Chrome stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Android users should verify their Chrome version via Settings > About Chrome and apply the update through the Google Play Store. As a compensating control prior to patching, disabling Autofill in Chrome Android (Settings > Autofill and passwords > toggle off payment methods, addresses, and passwords autofill) removes the vulnerable code path but eliminates autofill functionality - a trade-off acceptable in high-sensitivity environments. Enterprise administrators can enforce the minimum version via Android Enterprise MDM policies (e.g., Chrome Browser Cloud Management minimum version policy). No workaround fully substitutes for patching.