What is the CVSS score of CVE-2026-17742?

CVE-2026-17742 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17742?

Yes, a patch is available for CVE-2026-17742. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17742

EUVD-2026-50692 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-6w2g-v76x-hqg8

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N); victim must actively visit (UI:R); no privileges needed to serve HTML (PR:N); only limited confidentiality disclosure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:43 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.

Technical ContextAI

CWE-346 (Origin Validation Error) describes a failure to adequately verify that a resource or piece of data originates from a trusted or expected origin before acting on it. In this case, Chrome's Payments subsystem - the browser-native implementation supporting the Payment Request API and related functionality - does not sufficiently enforce cross-origin isolation policies, permitting a malicious page to observe or extract data belonging to a different web origin. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to 151.0.7922.72. This class of bug typically arises when browser subsystems implement their own resource-loading or messaging pathways that bypass or underenforce the same-origin policy checks applied at the main browser engine level.

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which resolves the insufficient policy enforcement in the Payments subsystem. The vendor patch is confirmed available via the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For environments where immediate patching is not feasible, a compensating control is to disable or restrict access to payment-related web features via enterprise policy (e.g., setting PaymentMethodQueryEnabled to false in Chrome enterprise policy), though this will break legitimate web-based payment flows. Organizations with Chrome Browser Cloud Management can enforce the policy centrally. Given the limited confidentiality impact and the requirement for user interaction, this is not an emergency patch priority but should be included in the next standard patch cycle.