What is the CVSS score of CVE-2026-17733?

CVE-2026-17733 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17733?

Yes, a patch is available for CVE-2026-17733. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17733

EUVD-2026-50683 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-7m8x-rgjh-8gvw

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring passive user navigation; only partial confidentiality impact from cross-origin data leak; no integrity or availability impact applicable.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:49 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.

Technical ContextAI

QUIC (Quick UDP Internet Connections) is Google's application-layer transport protocol underpinning HTTP/3, implemented natively in Chrome. CWE-346 (Origin Validation Error) identifies the root cause as a failure to properly validate origin boundaries within the QUIC stack - specifically on Android - allowing the protocol to serve or expose response data from one origin to a requesting context from a different origin, violating the browser's same-origin policy. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to 151.0.7922.72; the CVE description explicitly scopes this to the Android platform, suggesting the flaw may be tied to Android-specific QUIC socket handling or network stack integration rather than the shared cross-platform Chromium codebase.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Users and administrators should update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store or Chrome's built-in update mechanism. The stable channel update details are published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control for environments where immediate patching is not possible, disabling or restricting QUIC via enterprise policy (chrome://flags/#enable-quic set to Disabled, or via the QuicAllowed enterprise policy) would eliminate the attack surface for this specific flaw; note that this forces fallback to TCP-based HTTP/2, which may increase latency for QUIC-optimized services. No workaround fully substitutes for the patch.