What is the CVSS score of CVE-2026-17762?

CVE-2026-17762 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17762?

Yes, a patch is available for CVE-2026-17762. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17762

EUVD-2026-50711 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-4h42-5qrh-hrmp

Information Disclosure Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page, no privileges needed, user must visit page (UI:R), limited cross-origin read only (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:44 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.

Technical ContextAI

CWE-346 (Origin Validation Error) describes failures to properly verify that data or messages originate from the expected source, which in browser contexts directly undermines the Same-Origin Policy (SOP) - the foundational isolation mechanism separating web origins. Chrome on iOS operates under constraints distinct from desktop Chrome because Apple mandates use of the WebKit rendering engine on iOS, meaning Chrome for iOS uses a platform-specific implementation layer that diverges from Chromium's standard Blink engine. This divergence creates iOS-unique code paths where origin-boundary enforcement may be implemented differently, introducing surface area for subtle logic errors. The affected CPE (cpe:2.3:a:google:chrome) scoped to the iOS platform corroborates that this flaw is confined to the iOS implementation rather than shared Chromium code. The consequence is that attacker-controlled page content can read data belonging to a different origin than intended.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the only confirmed fix per the vendor advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If an immediate App Store update is not feasible in managed iOS environments, organizations can instruct users to use Safari or another WebKit-based browser as a temporary alternative, which avoids the vulnerable Chrome-specific implementation - note this may affect enterprise app compatibility or browser policy compliance. No server-side compensating controls exist for this client-side browser flaw, as the vulnerability resides entirely within the Chrome iOS application. Enforcing mobile device management (MDM) policies that restrict browsing to updated browser versions is advisable for security-sensitive environments.