What is the CVSS score of CVE-2026-17739?

CVE-2026-17739 has a contested CVSS base score of 4.2 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17739?

Yes, a patch is available for CVE-2026-17739. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17739

EUVD-2026-50689 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 Chrome

GHSA-jxrj-j9xc-wfqg

XSS Google

Medium

Disputed · 4.2 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

UXSS implies cross-origin script injection beyond the extension's own scope, warranting S:C; all other metrics align with vendor assignment.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:27 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

4.2 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.2

DescriptionCVE.org

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables Universal Cross-Site Scripting (UXSS), allowing an attacker who socially engineers a user into installing a malicious extension to inject arbitrary scripts or HTML across web origins. CVSS scores this at 4.2 (Medium) with high attack complexity reflecting the required social engineering; EPSS is negligible at 0.13% (3rd percentile). No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, suggesting it has not seen widespread or automated exploitation.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting), but manifests as UXSS - a class of XSS that leverages browser-level privileges to bypass the Same-Origin Policy. Chrome's extension architecture grants extensions elevated content-script access to web pages; insufficient policy enforcement in how extensions interact with page contexts allows a malicious extension to inject arbitrary scripts or HTML into page origins it should not control. The affected component is the Extensions subsystem of Google Chrome, confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all platforms. UXSS is more severe than reflected XSS because it crosses origin boundaries within the browser, potentially affecting any open tab or page session, not just the site the extension targets.

RemediationAI

The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this to most users automatically; administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or Group Policy and confirm the installed version is at or above 151.0.7922.72. As a compensating control prior to patching, organizations should enforce extension allowlisting via Chrome enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to prevent installation of unapproved extensions - this directly blocks the prerequisite attack step and has the trade-off of requiring administrative overhead to maintain approved extension lists. Disabling developer mode extensions in managed environments also reduces sideloading risk.