What is the CVSS score of CVE-2026-17788?

CVE-2026-17788 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17788?

Yes, a patch is available for CVE-2026-17788. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17788

EUVD-2026-50737 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-xf5r-63q4-hrxq

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring user visit (UI:R, PR:N); impact limited to partial cross-origin confidentiality disclosure with no integrity or availability consequences.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:48 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.

Technical ContextAI

Blink is the rendering engine embedded in Google Chrome responsible for parsing HTML, CSS, and JavaScript and enforcing browser security boundaries. CWE-346 (Origin Validation Error) identifies the root cause as improper enforcement of the Same-Origin Policy (SOP), the fundamental browser security mechanism preventing scripts from one origin from reading resources belonging to another. The 'inappropriate implementation' label indicates a logic flaw in some Blink feature or API that fails to correctly verify or enforce origin boundaries during page rendering, allowing cross-origin data to be accessed and exfiltrated. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop platforms (Windows, macOS, Linux). The specific Blink subsystem responsible is not disclosed in public data; the Chromium issue tracker reference (issues.chromium.org/issues/513824957) likely contains technical detail under a restricted disclosure.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later immediately; this is the vendor-confirmed patched release per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most desktop installations auto-update, but enterprise environments managing Chrome via group policy or endpoint management (e.g., Google Admin, Intune) should force the update push. As a temporary compensating control while patching is underway, enforcing Chrome's Site Isolation policy (--site-per-process, enabled by default in modern Chrome but verifiable via chrome://flags) reduces cross-origin data exposure surface; however, this does not fully mitigate the Blink logic flaw. Restricting user navigation to untrusted external HTML pages via browser policy or proxy filtering may reduce exposure but carries significant usability trade-offs in most environments.