What is the CVSS score of CVE-2026-17775?

CVE-2026-17775 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17775?

Yes, a patch is available for CVE-2026-17775. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17775

EUVD-2026-50724 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-47ch-8787-3hvh

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page requires active user visit (UI:R); no authentication needed; impact is limited read-only cross-origin data disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:47 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.

Technical ContextAI

The W3C Presentation API is a browser interface enabling web pages to control secondary displays or initiate presentation sessions to cast-capable receivers; it is enabled by default in Chromium-based browsers. CWE-346 (Origin Validation Error) identifies the root cause as Chrome's PresentationAPI implementation failing to enforce strict origin boundaries during presentation session handling, allowing data from one origin to be read by a distinct attacker-controlled origin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome across all desktop platforms (Windows, macOS, Linux) for all versions prior to 151.0.7922.72. The Same-Origin Policy is the browser's primary isolation primitive; a bypass here enables cross-site data theft without any elevated OS-level access.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this to most managed endpoints without administrator intervention; verify rollout completion via fleet management tooling. For environments where immediate patching is not feasible, consider disabling the Presentation API through Chrome enterprise policy (PresentationReceiverEnabled set to false), though this will break legitimate screen-casting and presentation workflows - assess the trade-off before deploying. Restricting users from navigating to untrusted external sites via web proxy allowlisting reduces attack surface but does not eliminate risk from compromised ad networks or trusted-but-compromised sites.