What is the CVSS score of CVE-2026-17824?

CVE-2026-17824 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17824?

Yes, a patch is available for CVE-2026-17824. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17824

EUVD-2026-50773 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-mr3q-6x9r-3w9m

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered browser flaw needing no attacker privileges; victim must visit crafted page (UI:R); SOP bypass yields integrity impact with no data disclosure or service disruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:30 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.

Technical ContextAI

ServiceWorker is a browser-native background script API that intercepts and controls network requests, enabling offline caching, push notifications, and Progressive Web App (PWA) functionality. In Chrome's implementation prior to 151.0.7922.72, policy controls governing ServiceWorker cross-origin behavior were insufficiently enforced (CWE-284: Improper Access Control), allowing a malicious ServiceWorker registered from a crafted page to circumvent the same-origin policy - the foundational browser boundary that isolates resources between different web origins. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds before the patched release. The Chromium bug tracker reference (https://issues.chromium.org/issues/517655343) likely contains technical specifics but is expected to be access-restricted until broader patch uptake is achieved.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor stable-channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify deployment via fleet management tools or the chrome://policy endpoint. If immediate updating is blocked by change-control processes, a compensating control is to disable ServiceWorker functionality through Chrome enterprise policy (ServiceWorkerEnabled=false), though this breaks PWA support and offline caching for all sites - a meaningful functional trade-off. Restricting navigation to untrusted or unsolicited URLs via web proxy or Safe Browsing enforcement also reduces exposure, given that user interaction with a crafted page is required for exploitation.