What is the CVSS score of CVE-2026-17799?

CVE-2026-17799 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17799?

Yes, a patch is available for CVE-2026-17799. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17799

EUVD-2026-50748 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-p6vr-qm9c-fq9v

Authentication Bypass Google

Medium

Disputed · 5.4 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network delivery via malicious file with mandatory user interaction; DAC bypass yields only partial C/I with no availability or scope-change impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 15:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.4

DescriptionCVE.org

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.

Technical ContextAI

Google Chrome's Safe Browsing feature is a client-side protection subsystem that inspects URLs, downloads, and files against threat intelligence feeds to warn users of potentially dangerous content. CWE-20 (Improper Input Validation) identifies the root cause: the Safe Browsing component does not sufficiently validate data originating from an untrusted file before acting on it, allowing an attacker-controlled input to influence an access control decision in an unintended way. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop instances across platforms (Windows, macOS, Linux) running versions prior to 151.0.7922.72. Because Safe Browsing is a default-on feature, no special configuration is required for the vulnerable code path to be reachable.

RemediationAI

The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later, as released in the stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most consumer Chrome installations will receive this update automatically; enterprise administrators using Google Admin Console, Microsoft Intune, or similar MDM tooling should verify the patch has propagated across managed endpoints. As a compensating control where immediate patching is not operationally feasible, switching Safe Browsing to Enhanced Protection mode (rather than Standard) adds additional server-side telemetry checks that may reduce bypass effectiveness, though this does not eliminate the underlying vulnerability. Blocking execution of files from untrusted or external sources at the endpoint or email gateway level reduces the attack surface by limiting attacker-controlled file delivery. No side effects from the patch itself have been reported.