What is the CVSS score of CVE-2026-17808?

CVE-2026-17808 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17808?

Yes, a patch is available for CVE-2026-17808. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17808

EUVD-2026-50757 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-37j8-4gfm-7j42

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L), no attacker privileges needed (PR:N), user must visit the page (UI:R), confidentiality-only impact limited to partial cross-origin data leakage (C:L, I:N, A:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:49 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows a remote attacker to read memory contents belonging to other origins via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. The vulnerability stems from uninitialized memory use (CWE-457) in the WebGL subsystem, exposing stale memory that may contain sensitive cross-origin data. No public exploit code exists and EPSS sits at 0.23% (14th percentile), indicating low current exploitation probability; this is not listed in CISA KEV.

Technical ContextAI

WebGL (Web Graphics Library) is a browser API exposing OpenGL ES capabilities to JavaScript for 2D and 3D rendering. CWE-457 (Use of Uninitialized Variable) describes a root cause where memory or a variable is read before being properly initialized, potentially exposing whatever data previously occupied that memory region. In this case, the Chrome WebGL implementation on Android fails to zero or otherwise initialize a memory region before it is accessible to a web page's JavaScript context, allowing a crafted page to observe residual memory contents that may originate from a different, protected origin. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Google Chrome broadly; the Android platform constraint is specified in the CVE description and is critical to scoping the affected surface.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later. The patch is available via the Chrome Stable Channel update documented at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Android users should allow automatic Chrome updates via Google Play or manually trigger an update in Play Store. If immediate patching is operationally constrained, a compensating control is to restrict or disable WebGL in managed Chrome deployments via the WebGLEnabled enterprise policy - note this will break any web applications relying on WebGL rendering. Given the information-disclosure-only impact and low EPSS, this vulnerability fits a standard patch-cycle response rather than emergency remediation.