What is the CVSS score of CVE-2026-17813?

CVE-2026-17813 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17813?

Yes, a patch is available for CVE-2026-17813. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17813

EUVD-2026-50762 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-g9jw-mrc3-q55j

Google Apple Authentication Bypass Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted webpage (AV:N), no privileges needed (PR:N), user must visit page (UI:R), navigation bypass yields high integrity impact with no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:25 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Hosts page on attacker-controlled server

Exploit

Victim tricked into visiting URL in Chrome for iOS

Execution

Crafted page triggers insufficient policy enforcement

Persist

Navigation restrictions bypassed

Impact

Attacker-controlled navigation executed in victim browser

Access

Attacker crafts malicious HTML page

Delivery

Hosts page on attacker-controlled server

Exploit

Victim tricked into visiting URL in Chrome for iOS

Execution

Crafted page triggers insufficient policy enforcement

Persist

Navigation restrictions bypassed

Impact

Attacker-controlled navigation executed in victim browser

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim is running Google Chrome on an iOS device at a version prior to 151.0.7922.72 and that the victim visits a specially crafted HTML page - establishing a UI:R (user interaction required) constraint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N yields a 6.5 Medium, driven primarily by network accessibility, zero privilege requirement, and High integrity impact - while user interaction is required and there is no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker constructs a malicious HTML page designed to trigger Chrome for iOS's insufficient policy enforcement and hosts it on an attacker-controlled server. A victim on an unpatched iOS device is socially engineered - via phishing email, SMS, or malicious advertisement - into opening the link in Chrome for iOS. …
Remediation	The primary fix is to update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.