What is the CVSS score of CVE-2026-17795?

CVE-2026-17795 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17795?

Yes, a patch is available for CVE-2026-17795. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17795

EUVD-2026-50744 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-6gf6-mm34-77mm

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Renderer compromise prerequisite elevates AC to H; no auth, integrity, or availability impact applies to this specific flaw.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:48 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in GetUserMedia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.

Technical ContextAI

GetUserMedia is part of the W3C MediaDevices API (WebRTC stack), enabling web pages to request access to camera, microphone, and screen capture streams. Chrome's implementation of this API contains a CWE-20 (Improper Input Validation) flaw - an 'inappropriate implementation' indicating a logic or enforcement error rather than a memory corruption issue. The root cause likely involves insufficient enforcement of cross-origin restrictions when processing media-related requests from within a compromised renderer context. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases before 151.0.7922.72 across all platforms and architectures, per EUVD-2026-50744.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch per the Chrome Releases stable channel update at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch automatically in most consumer and enterprise deployments; verify via chrome://settings/help. Where immediate update is not feasible, enterprise administrators can restrict or disable the GetUserMedia/MediaDevices API using Chrome enterprise policies (MediaVideoCapture and MediaAudioCapture permission policies), which eliminates the attack surface for this specific flaw; note this trade-off breaks camera and microphone functionality for all users under that policy. Restricting access to untrusted web content via URL allowlisting (URLBlocklist policy) also reduces exposure, at the cost of limiting general browsing.