What is the CVSS score of CVE-2026-17796?

CVE-2026-17796 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17796?

Yes, a patch is available for CVE-2026-17796. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17796

EUVD-2026-50745 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-07-30 Chrome

GHSA-9hh3-vfmx-fj86

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N), no attacker privileges needed (PR:N), user must visit the page (UI:R), memory read yields high confidentiality loss (C:H), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:45 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.

Technical ContextAI

WebXR is a browser API enabling augmented and virtual reality experiences directly within web content. The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels), meaning the root cause is an observable behavioral or timing artifact in the WebXR subsystem that permits an attacker to infer process memory contents without direct memory access. This class of flaw exploits measurable differences in execution time, cache state, or resource utilization rather than a classic memory corruption primitive. The affected product is Google Chrome across all platforms as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the vulnerability present in all versions before 151.0.7922.72.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed enterprise environments, prioritize deployment via Chrome Browser Cloud Management or Group Policy to enforce the minimum version. As a short-term compensating control prior to patching, disabling WebXR access via enterprise policy (restricting the WebXR API through Chrome's content settings or enterprise policy ChromeWebXREnabled if available) would eliminate the attack surface, though this will break any legitimate WebXR applications in use. Browser isolation technologies (e.g., mandatory use of Site Isolation profiles) may reduce but cannot fully eliminate side-channel memory leakage risks. No alternative workaround eliminates the vulnerability without restricting the WebXR feature.