What is the CVSS score of CVE-2026-17759?

CVE-2026-17759 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17759?

Yes, a patch is available for CVE-2026-17759. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17759

EUVD-2026-50708 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-w2c6-v386-mfrw

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML, no privileges needed, but requires user to visit the page; only confidentiality impacted through memory leak, no write or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:36 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a class of defect where a memory region is read before it has been written with defined values, causing the program to consume whatever residual bytes reside in that allocation. In Google Chrome, this flaw manifests within the codec processing pipeline - the subsystem responsible for decoding audio and video media embedded in or referenced by HTML pages. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* encompasses all desktop Chrome builds across Windows, macOS, and Linux. When a specially crafted HTML page triggers codec path execution, the uninitialized buffer may contain fragments of prior heap allocations from the renderer process, which can include sensitive data such as decrypted content, authentication tokens, or partial DOM state.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which resolves this flaw as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this patch automatically for most users; administrators managing enterprise deployments should push the update via policy or verify the installed version in chrome://settings/help. As a compensating control prior to patching, restricting access to untrusted or external websites via browser policy or network filtering reduces exposure, though this trades off browsing functionality. No workaround fully mitigates the underlying uninitialized-memory defect short of the vendor patch.