What is the CVSS score of CVE-2026-17810?

CVE-2026-17810 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17810?

Yes, a patch is available for CVE-2026-17810. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17810

EUVD-2026-50759 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-7hvm-x3c6-5694

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no auth needed (PR:N), active user visit required (UI:R), limited data leak with no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:50 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted WebGPU HTML page

Delivery

Victim clicks link and loads page in unpatched Chrome

Exploit

Dawn processes WebGPU calls triggering uninitialized memory read

Execution

Cross-origin memory contents exposed to attacker JavaScript

Impact

Attacker exfiltrates leaked data to remote server

Access

Attacker hosts crafted WebGPU HTML page

Delivery

Victim clicks link and loads page in unpatched Chrome

Exploit

Dawn processes WebGPU calls triggering uninitialized memory read

Execution

Cross-origin memory contents exposed to attacker JavaScript

Impact

Attacker exfiltrates leaked data to remote server

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome prior to version 151.0.7922.72 on a desktop platform and must actively visit (or be redirected to) an attacker-controlled HTML page - user interaction is required (UI:R per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N and score of 4.3 accurately represent the risk envelope: the flaw is network-reachable with low complexity but mandates user interaction and delivers only limited confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts an HTML page containing WebGPU API calls designed to trigger Dawn's uninitialized memory path, then lures a victim (via phishing link or malvertising) into visiting the page in a vulnerable Chrome browser. The malicious JavaScript reads the leaked memory contents and exfiltrates them to an attacker-controlled server, potentially exposing session tokens, page fragments, or other sensitive data from cross-origin contexts loaded in the same browser process. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.