What is the CVSS score of CVE-2026-17813?

CVE-2026-17813 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17813?

Yes, a patch is available for CVE-2026-17813. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17813

EUVD-2026-50762 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-g9jw-mrc3-q55j

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted webpage (AV:N), no privileges needed (PR:N), user must visit page (UI:R), navigation bypass yields high integrity impact with no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:25 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) describes a class of flaws where security controls are implemented on the client side and can therefore be bypassed by a malicious actor controlling the input. In Chrome for iOS, navigation restriction policies - such as those governing cross-origin navigation, popup blocking, or redirect controls - are enforced at the browser's policy layer. When a specially crafted HTML page is rendered, it can exploit gaps in how Chrome for iOS evaluates or applies these policies, causing the browser to permit navigation actions it should otherwise block. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, though the vulnerability is scoped specifically to the iOS platform variant as stated in the CVE description, a distinction the broad CPE string does not capture.

RemediationAI

The primary fix is to update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS fleets via MDM should push the update through their mobile device management solution. As an interim compensating control prior to patching, users should be instructed not to follow links from untrusted sources in Chrome for iOS; this reduces exposure given the UI:R attack requirement but does not eliminate it. Restricting access to untrusted external web content at the network or DNS filtering layer can further reduce exposure, though this carries usability trade-offs. No workaround eliminates the vulnerability without patching.