What is the CVSS score of CVE-2026-17792?

CVE-2026-17792 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17792?

Yes, a patch is available for CVE-2026-17792. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17792

EUVD-2026-50741 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-m86q-hvj4-mh7m

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page requires passive user visit (UI:R); no privileges or special config needed; spoofed credential UI yields high integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:39 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.

Technical ContextAI

The vulnerability resides in Google Chrome's Credential Management subsystem, which exposes browser-stored credentials and credential prompt UI to web content through the Credential Management API. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as the browser failing to correctly validate or constrain how credential-related UI is rendered in response to crafted page content, allowing a web page to effectively spoof the appearance of trusted credential dialogs. The affected product spans all Chrome desktop builds prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The Chromium project rated this Medium severity, which aligns with a UI-layer integrity issue rather than a memory corruption or code execution class flaw. Chromium issue tracker reference 514019823 tracks the underlying defect.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-confirmed fix per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default - verify the installed version via chrome://settings/help and trigger a manual update check if auto-update has been delayed. For enterprise environments unable to deploy immediately, use Chrome browser policy (e.g., URLBlocklist) or a web proxy to restrict navigation to untrusted external sites, since exploitation requires the user to visit a crafted HTML page; this reduces exposure at the cost of limiting general browsing. No vendor-documented workaround exists to selectively disable Credential Management without broader functional impact.