What is the CVSS score of CVE-2026-17754?

CVE-2026-17754 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17754?

Yes, a patch is available for CVE-2026-17754. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17754

EUVD-2026-50704 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-v874-3455-525x

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML page (AV:N, AC:L, PR:N, UI:R); SOP bypass enables cross-origin writes but not reads, yielding I:H and C:N with scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:45 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to violate cross-origin isolation boundaries by luring a user to visit a specially crafted HTML page. The CVSS vector assigns High integrity impact with no privilege requirement, meaning successful exploitation could enable an attacker to inject or manipulate cross-origin content within the victim's browser session. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), with SSVC confirming no observed exploitation - placing this in the patch-on-schedule rather than emergency-response tier.

Technical ContextAI

Blink is Google Chrome's HTML rendering engine, responsible for parsing and executing web content including enforcement of the same-origin policy (SOP) - the foundational browser security boundary that prevents JavaScript in one origin from reading or writing resources belonging to another. The root cause is classified as CWE-346 (Origin Validation Error), indicating that a specific implementation path in Blink fails to correctly validate the origin of an operation before permitting it. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop builds; the EUVD entry EUVD-2026-50704 and vendor advisory narrow the affected range to all versions below 151.0.7922.72. The exact Blink code path is not yet publicly disclosed, consistent with the Chromium issue tracker reference (issues.chromium.org/issues/501675996) likely being restricted to allow patch propagation before full disclosure.

RemediationAI

The definitive fix is upgrading Google Chrome to version 151.0.7922.72 or later, as released in the stable desktop channel and documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism handles this transparently for most consumer deployments; enterprise administrators using managed browser policies (Google Admin Console, Chrome Browser Cloud Management, or GPO-based deployment) should verify that the stable channel version has propagated to managed endpoints and confirm via fleet inventory. If an immediate upgrade is operationally blocked, a compensating control is to restrict end-user browsing to allowlisted trusted origins via enterprise URL filtering or Chrome's managed site list policy - this limits the attack surface but introduces significant usability trade-offs and is not a substitute for patching. No vendor-documented workarounds exist beyond the patch.