What is the CVSS score of CVE-2026-17787?

CVE-2026-17787 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17787?

Yes, a patch is available for CVE-2026-17787. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17787

EUVD-2026-50736 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-765r-wfrw-h7w2

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N, AC:L), no privileges needed (PR:N), victim must visit page (UI:R); SOP bypass enables cross-origin writes only (I:H), with no confidentiality or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:44 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows an unauthenticated remote attacker to perform unauthorized cross-origin write operations against a victim's browser context. Exploitation requires the victim to visit a specially crafted HTML page (UI:R), making it a socially-engineered threat rather than a purely opportunistic one. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing or public exploit code has been identified, consistent with the Chromium team's own 'Medium' severity rating; however, Chrome's ubiquitous deployment makes even medium-severity findings broadly relevant.

Technical ContextAI

Google Chrome's DevTools is a built-in browser subsystem providing developer debugging, profiling, and DOM inspection capabilities. The Same-Origin Policy (SOP) is the browser's primary isolation mechanism, preventing scripts from one origin from interacting with resources from another. CWE-346 (Origin Validation Error) describes failures to properly verify the origin of a communication channel or data, which is the root cause here: an inappropriate implementation within DevTools incorrectly validates or fails to enforce origin boundaries. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to 151.0.7922.72 across platforms. The CVSS integrity-only impact (I:H, C:N) suggests the bypass enables cross-origin writes but not reads, which is characteristic of certain classes of SOP confusion or message-channel misrouting bugs rather than full cross-origin data exfiltration.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, as documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates on most consumer installations; verify by navigating to chrome://settings/help. Enterprise administrators managing fleet deployments via Google Admin Console or third-party MDM should push this update through their software distribution pipeline. If immediate patching is not feasible, restricting Chrome DevTools access in managed environments via the DeveloperToolsAvailability Chrome policy (set to 2 to disallow) reduces the attack surface at the cost of breaking developer workflows for affected users. Blocking navigation to untrusted or unknown external URLs via web proxy or DNS filtering can reduce exposure to crafted HTML delivery, but is not a full mitigation. No vendor-published workaround fully substitutes for the patch.