What is the CVSS score of CVE-2026-17818?

CVE-2026-17818 has a contested CVSS base score of 6.1 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17818?

Yes, a patch is available for CVE-2026-17818. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17818

EUVD-2026-50767 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 Chrome

GHSA-rgcf-qx52-6g7x

XSS Google

Medium

Disputed · 6.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered UXSS requires only victim page visit (PR:N, UI:R); cross-origin script injection justifies S:C; C:L/I:L reflect limited but real cross-origin data access and manipulation.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:26 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

6.1 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component allows remote attackers to inject arbitrary scripts or HTML across same-origin policy boundaries via a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Unlike application-level XSS, UXSS exploits a flaw in the browser engine itself, enabling cross-origin script execution that bypasses website-level security controls. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), but the confirmed scope change (S:C in CVSS) signals genuine cross-origin impact potential.

Technical ContextAI

CWE-79 (Cross-site Scripting) here manifests as UXSS - a browser-level variant that exploits improper handling within Chrome's Network component rather than a flaw in any specific web application. Where standard XSS is confined to the vulnerable site's origin, UXSS leverages the browser's own logic errors to inject scripts that execute across origin boundaries, undermining the same-origin policy enforced by the browser. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome releases across platforms up to the fix version. The CVSS Scope:Changed metric is the technical signal confirming cross-origin impact, consistent with UXSS behavior where the exploited component (Chrome's network layer) affects resources in other origins beyond the attacker's page.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise environments should push the update via Google Chrome's enterprise management (e.g., Google Admin, Intune) or allow Chrome's auto-update mechanism to apply it. As a compensating control prior to patching, organizations can enforce Chrome enterprise policies to restrict navigation to known-good URL allowlists, though this carries a significant productivity trade-off. Blocking or sandboxing untrusted web content at the proxy or DNS layer can also reduce attack surface for drive-by scenarios. There are no non-update workarounds that fully mitigate browser-engine-level UXSS.