What is the CVSS score of CVE-2026-17815?

CVE-2026-17815 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17815?

Yes, a patch is available for CVE-2026-17815. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17815

EUVD-2026-50764 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-fjfr-63v9-742p

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges needed, mandatory user interaction, scope unchanged, impact limited to partial cross-origin data disclosure only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:48 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.

Technical ContextAI

GuestView is a Chrome subsystem responsible for rendering embedded guest content inside <webview> tags, used primarily in Chrome Apps, packaged extensions, and Electron-style desktop applications. CWE-346 (Origin Validation Error) indicates the browser fails to enforce same-origin or cross-origin isolation policies within this subsystem, allowing a malicious guest frame or host page to read data from a different origin than intended. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to the 151.0.7922.72 stable release. The Chromium issue tracker entry at https://issues.chromium.org/issues/517427352 may contain additional technical detail but is not publicly accessible.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates on consumer systems; enterprise administrators should verify patch deployment via chrome://settings/help or fleet management tooling. If immediate patching is not feasible, restricting or disabling Chrome extensions and apps that embed <webview> GuestView contexts can reduce the attack surface, though this will break extension functionality that relies on guest content. Blocking navigation to untrusted or unknown web origins at the network perimeter provides a further compensating control, though it does not address the underlying flaw. No formal vendor workaround beyond patching is documented in the available references.