What is the CVSS score of CVE-2026-17732?

CVE-2026-17732 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-17732?

Yes, a patch is available for CVE-2026-17732. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17732

EUVD-2026-50679 LOW

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-q7gj-pj54-2g7f

Information Disclosure Google

3.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

AV:N for web-delivered exploit; AC:H for unspecified browser state prerequisites; PR:N since no attacker account needed; UI:R for required victim page visit; C:L for partial cross-origin data leak only.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:50 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

LOW 3.1

DescriptionCVE.org

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.

Technical ContextAI

The vulnerability exists in Google Chrome's SVG (Scalable Vector Graphics) rendering subsystem, which is part of the Blink rendering engine embedded in Chromium. SVG elements natively support cross-origin resource references (e.g., image, filter, use elements pointing to external URIs), and an inappropriate implementation in Chrome's SVG handling failed to correctly enforce origin validation per CWE-346 (Origin Validation Error). This class of flaw allows attacker-controlled SVG constructs to observe or extract data from cross-origin contexts that the same-origin policy is meant to isolate. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome releases prior to 151.0.7922.72 carry this flaw across all platforms.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the Chrome Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome typically auto-updates silently; users can verify and trigger an update manually via the browser menu at Help > About Google Chrome. Enterprise administrators should ensure managed Chrome deployments are enrolled in a channel that has received the 151.0.7922.72 stable update. If immediate patching is not feasible, reducing exposure to untrusted web content via enterprise browser policies (e.g., restricting navigation to allowlisted domains) would reduce attack surface, though this trades significant usability impact for a low-severity information disclosure risk.