What is the CVSS score of CVE-2026-17819?

CVE-2026-17819 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17819?

Yes, a patch is available for CVE-2026-17819. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17819

EUVD-2026-50768 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-j4f7-2v7w-hc88

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page, no privileges required, but user must interact with spoofed UI; integrity-only impact as attacker manipulates perceived interface, not underlying data.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:29 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.

Technical ContextAI

The vulnerability resides in Chrome's WebAppInstalls subsystem, which governs the Progressive Web App (PWA) installation prompt lifecycle - the browser chrome UI triggered when a site requests to be installed as a desktop or home-screen application. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause class: the implementation fails to enforce integrity of the installation UI surface, allowing an attacker-controlled page to manipulate or spoof the prompt in ways users cannot distinguish from legitimate browser UI. The affected product scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms prior to the fixed version. The Chromium issue tracker entry (https://issues.chromium.org/issues/517487028) is the upstream defect record, though technical details may be restricted pending broader patch adoption.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The update is available through Chrome's built-in auto-update mechanism or manually via Help > About Google Chrome. Enterprise deployments managed via Google Admin Console or MDM solutions should push the policy-forced update to all managed endpoints promptly. No documented workarounds exist for this flaw; the patch is the sole confirmed remediation. As a limited compensating control pending upgrade, administrators may consider blocking access to unknown external sites via web proxy policy, though this does not eliminate risk for sites users are permitted to visit and is not a substitute for patching.