What is the CVSS score of CVE-2026-17814?

CVE-2026-17814 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17814?

Yes, a patch is available for CVE-2026-17814. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17814

EUVD-2026-50763 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-8p2g-mp84-gmvm

Google Apple Authentication Bypass Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted HTML requires no privileges, but UI:R applies as user must load the page; navigation bypass yields I:H with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:26 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious HTML page

Delivery

Host on attacker-controlled domain

Exploit

Lure iOS Chrome user via phishing or malvertising

Execution

User loads crafted page in Chrome for iOS

Persist

Trigger insufficient input validation in navigation subsystem

Impact

Bypass navigation restrictions

Access

Craft malicious HTML page

Delivery

Host on attacker-controlled domain

Exploit

Lure iOS Chrome user via phishing or malvertising

Execution

User loads crafted page in Chrome for iOS

Persist

Trigger insufficient input validation in navigation subsystem

Impact

Bypass navigation restrictions

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target to be running Google Chrome on Apple iOS with a version strictly below 151.0.7922.72 - this vulnerability does not apply to Chrome on Android, Windows, macOS, or Linux. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 Medium score reflects a network-accessible, zero-prerequisite attack limited by required user interaction (UI:R) and a scope-unchanged impact boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that exploits the input validation flaw in Chrome for iOS's navigation subsystem and hosts it on an attacker-controlled domain. The victim, running an unpatched version of Chrome on an iOS device, is directed to the page via a phishing link, malicious advertisement, or redirect chain. …
Remediation	Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which constitutes the vendor-released patch for this vulnerability per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.