What is the CVSS score of CVE-2026-17812?

CVE-2026-17812 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17812?

Yes, a patch is available for CVE-2026-17812. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17812

EUVD-2026-50761 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-qgxw-xv94-599v

Information Disclosure Google

Medium

Disputed · 5.4 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network delivery via crafted HTML with no privileges needed; UI:R required; A:N because UI spoofing does not cause service disruption, contradicting the upstream A:L metric.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:25 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

5.4 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.4

DescriptionCVE.org

Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.

Technical ContextAI

The DigitalCredentials API is a browser-level web platform API designed to facilitate the presentation and verification of digital identity credentials - such as digital driver's licenses or government IDs - within web contexts. CWE-451 (User Interface Misrepresentation of Critical Information) describes vulnerabilities where the UI fails to accurately represent security-sensitive information to users, enabling attacker-crafted content to masquerade as legitimate browser or credential-provider UI. An inappropriate implementation in this API within Chromium-based Google Chrome means the browser does not correctly enforce UI boundaries or origin indicators when rendering credential dialogs, allowing crafted HTML to inject or spoof those elements. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 151.0.7922.72 on all platforms.

RemediationAI

The primary remediation is updating Google Chrome to version 151.0.7922.72 or later, as confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should deliver this patch automatically on most endpoints; administrators managing enterprise deployments should verify rollout via Google Admin Console or group policy. If immediate upgrade is not feasible, restricting or disabling use of the DigitalCredentials API via enterprise policy (if a Chrome policy exists for this feature) would reduce exposure - however, this may break legitimate digital identity workflows. Blocking access to untrusted external web content via proxy or content filtering can reduce the attack surface since exploitation requires user navigation to a crafted HTML page. No workaround fully substitutes for patching, and none of these compensating controls carry confirmed effectiveness against all exploit variants.