What is the CVSS score of CVE-2026-17814?

CVE-2026-17814 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17814?

Yes, a patch is available for CVE-2026-17814. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17814

EUVD-2026-50763 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-8p2g-mp84-gmvm

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted HTML requires no privileges, but UI:R applies as user must load the page; navigation bypass yields I:H with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:26 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.

Technical ContextAI

The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's iOS-specific navigation processing code path. Unlike desktop Chrome or Chrome on Android, Chrome for iOS is constrained by Apple App Store policies to use WebKit as its underlying rendering engine, introducing a platform-specific code layer where input sanitization for navigation requests was found to be insufficient. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers the Chrome application broadly, but the vulnerability is explicitly scoped to the iOS variant per the CVE description. The flaw allows attacker-supplied HTML content to manipulate or bypass navigation restrictions - which could encompass same-origin navigation guards, URL scheme enforcement, or browser-internal navigation policy controls. The EUVD entry EUVD-2026-50763 confirms the affected version range as all Chrome for iOS releases prior to 151.0.7922.72.

RemediationAI

Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which constitutes the vendor-released patch for this vulnerability per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. iOS users should update through the Apple App Store. For enterprise environments unable to immediately deploy the patch, Mobile Device Management (MDM) solutions can be used to restrict Chrome navigation to approved domain allowlists, though this introduces significant usability trade-offs and will not prevent exploitation via allowed domains hosting malicious content. Restricting user access to untrusted web content via web proxies or DNS filtering reduces exposure but does not constitute a complete mitigation. No workaround is confirmed as fully effective absent the patch.