What is the CVSS score of CVE-2026-17753?

CVE-2026-17753 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17753?

Yes, a patch is available for CVE-2026-17753. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17753

EUVD-2026-50703 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-xp2r-cfm9-38xv

Information Disclosure Google Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page with no privileges needed, but user must visit the page; impact limited to partial cross-origin data disclosure only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:43 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.

Technical ContextAI

The Chromium Autofill component is responsible for populating form fields with stored user data (addresses, credit card numbers, credentials). CWE-346 (Origin Validation Error) indicates the subsystem does not adequately verify that an autofill operation is scoped to the page origin that originally stored or requested the data, permitting a cross-origin page to observe or receive autofill-supplied values it should not have access to. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to the fixed version 151.0.7922.72 across all platforms (Windows, macOS, Linux). This class of flaw is a browser-level same-origin policy bypass rather than a network-layer or OS-level issue, meaning exploitation is entirely contained within the browser rendering engine.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch to most users automatically; administrators managing enterprise Chrome deployments via policy should verify fleet-wide update propagation. As a compensating control where immediate upgrade is not feasible, disabling the Autofill feature (chrome://settings/autofill) eliminates the vulnerable code path entirely, though this removes convenience functionality for users relying on stored form data. Restricting navigation to untrusted external pages via browser policy or web filtering reduces the attack surface, since exploitation requires visiting a crafted HTML page. No side effects are associated with the patch itself.