What is the CVSS score of CVE-2026-17805?

CVE-2026-17805 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17805?

Yes, a patch is available for CVE-2026-17805. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17805

EUVD-2026-50754 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-v2g9-chcc-68jg

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML with no attacker privileges; victim must actively visit the page (UI:R); impact is navigation bypass only - integrity High, no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:23 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in the Glic component of Google Chrome for Android (versions prior to 151.0.7922.72) allows unauthenticated remote attackers to circumvent browser policy enforcement by directing victims to a crafted HTML page. The integrity-only impact (I:H) reflects the ability to navigate users past enforced restrictions, though confidentiality and availability are unaffected. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and the vulnerability is not listed in CISA KEV - vendor-released patch is available in Chrome 151.0.7922.72.

Technical ContextAI

Glic is Google's AI assistant overlay integrated into Chrome for Android, providing contextual assistance and navigation features. CWE-602 (Client-Side Enforcement of Server-Side Security) describes the root cause class: security policy that should be consistently enforced by the browser's navigation security model is instead insufficiently applied within the Glic component, allowing crafted HTML to subvert those controls. The flaw is specific to the Android platform implementation of Chrome, as desktop Chrome is not implicated by the description. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions below 151.0.7922.72 on Android. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N confirms network delivery via HTML content with no attacker privileges required, though victim interaction (page visit) is mandatory.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later, which is the vendor-released patch for this vulnerability per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise and MDM-managed Android fleets should confirm Chrome auto-update policies are enabled to accelerate patch distribution. If immediate update is not feasible, consider disabling the Glic AI overlay feature in Chrome for Android settings (chrome://flags or equivalent enterprise policy) as a compensating control - this eliminates the vulnerable code path at the cost of losing Glic's AI-assisted browsing functionality. No other workarounds are documented in available references. Patch application is strongly preferred over the Glic-disable workaround given Chrome's rapid update cadence.