What is the CVSS score of CVE-2026-17793?

CVE-2026-17793 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17793?

Yes, a patch is available for CVE-2026-17793. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17793

EUVD-2026-50742 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-7hw2-fq4x-x3c7

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered crafted HTML with mandatory victim click; no attacker auth needed; impact is integrity-only UI spoofing with no data exfiltration or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:28 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes failures in the rendering or isolation layer that allow attacker-controlled content to be visually indistinguishable from trusted UI elements. In this case, the Messages feature within Chrome for Android contains an 'inappropriate implementation' - meaning the component's HTML rendering or sandboxing logic does not sufficiently constrain how crafted content can manipulate the perceived UI, enabling phishing overlays, fake dialogs, or origin spoofing attacks. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected software is Google Chrome itself, not a third-party library. The Android platform restriction implies the Messages-specific code path is unique to Chrome's mobile implementation.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 for Android. Users should update immediately via the Google Play Store or Chrome's built-in update mechanism (Settings > About Chrome > Update). The fix is documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and tracked in Chromium issue 514063859. If immediate update is not feasible, users should avoid opening unsolicited or untrusted links within the Chrome Messages feature, as user interaction with a crafted page is required for exploitation. There are no configuration-level workarounds that fully mitigate a UI-layer spoofing flaw; the patch is the only confirmed remediation.