What is the CVSS score of CVE-2026-17740?

CVE-2026-17740 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17740?

Yes, a patch is available for CVE-2026-17740. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17740

EUVD-2026-50690 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-7hh8-39gf-453q

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML, user must visit page (UI:R), no attacker authentication needed, confidentiality-only leak with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:42 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer that translates OpenGL ES API calls to platform-native APIs including Direct3D (Windows), Metal (macOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) indicates that a memory region - in this context likely a GPU-accessible buffer or texture - is read before being explicitly zeroed or populated. Because GPU buffers can retain data from prior rendering operations across origins, uninitialized reads can expose content that was rendered in a different security origin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome desktop versions prior to 151.0.7922.72, as confirmed by EUVD-2026-50690.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch per the official stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates silently, but enterprise administrators should verify deployment of this version via fleet management tooling. As a compensating control prior to patching, enabling Chrome's Site Isolation (chrome://flags/#enable-site-per-process, on by default in modern Chrome) limits cross-origin data reachability and reduces the severity of ANGLE-level leaks, though it may not fully mitigate this specific vulnerability. Disabling hardware acceleration via Settings > System > 'Use graphics acceleration when available' would remove ANGLE from the rendering path entirely, but degrades rendering performance and video playback quality significantly and is not recommended for production use except as a temporary emergency measure.