What is the CVSS score of CVE-2026-17796?

CVE-2026-17796 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17796?

Yes, a patch is available for CVE-2026-17796. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17796

EUVD-2026-50745 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-07-30 Chrome

GHSA-9hh3-vfmx-fj86

Google Information Disclosure Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N), no attacker privileges needed (PR:N), user must visit the page (UI:R), memory read yields high confidentiality loss (C:H), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:45 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted WebXR HTML page

Delivery

Social engineer victim to visit URL

Exploit

Victim clicks to activate WebXR session

Execution

WebXR side-channel leaks process memory timing/cache signals

Impact

Attacker reconstructs sensitive memory fragments

Access

Attacker hosts crafted WebXR HTML page

Delivery

Social engineer victim to visit URL

Exploit

Victim clicks to activate WebXR session

Execution

WebXR side-channel leaks process memory timing/cache signals

Impact

Attacker reconstructs sensitive memory fragments

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim user visit an attacker-controlled web page and trigger interaction sufficient to activate the WebXR side-channel - consistent with CVSS UI:R. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity, unauthenticated attack with high confidentiality impact - which sounds alarming in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted WebXR content designed to elicit measurable side-channel signals from the Chrome rendering or XR process. When a user visits the page and triggers the WebXR session - for example, by clicking a 'Start VR experience' button - the attacker's JavaScript observes timing or cache-state artifacts to reconstruct fragments of process memory, potentially capturing sensitive data present in the process at that moment. …
Remediation	Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.