What is the CVSS score of CVE-2026-17810?

CVE-2026-17810 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17810?

Yes, a patch is available for CVE-2026-17810. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17810

EUVD-2026-50759 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-7hvm-x3c6-5694

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no auth needed (PR:N), active user visit required (UI:R), limited data leak with no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:50 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.

Technical ContextAI

Dawn is Chromium's cross-platform WebGPU graphics abstraction layer, responsible for translating WebGPU API calls into native GPU commands (via Metal, Vulkan, or D3D12). CWE-457 (Use of Uninitialized Variable) arises when allocated memory buffers are consumed before being zeroed or explicitly set, potentially exposing residual heap or stack contents from earlier allocations. In this context, a crafted HTML page can cause Dawn to process a WebGPU operation that reads uninitialized memory whose contents originate from a different browser origin, violating the Same-Origin Policy and constituting an information disclosure channel. The affected scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 151.0.7922.72 across platforms.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this for consumer installations; enterprise administrators should validate deployment status via chrome://settings/help or their endpoint management tooling. If immediate patching is blocked, restricting end-user access to untrusted or unknown web origins via network proxy policy or browser extension controls reduces exposure to the crafted-page delivery vector, though this is not a full mitigation and carries usability trade-offs. Disabling WebGPU entirely via enterprise policy (--disable-webgpu flag or corresponding GPUEnabled policy) would eliminate the Dawn attack surface but also breaks WebGPU-dependent web applications.