What is the CVSS score of CVE-2026-17825?

CVE-2026-17825 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17825?

Yes, a patch is available for CVE-2026-17825. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-17825

EUVD-2026-50774 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-h2gx-vw4g-334p

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page, no privileges needed, user must visit page (UI:R); integrity impact only - no credential disclosure or service disruption described.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:35 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), specifically a failure of policy enforcement within Chrome's Passwords subsystem on the Android platform. The Passwords component manages credential storage, autofill decisions, and access gating for saved credentials; insufficient enforcement of discretionary access control policies in this layer can allow a crafted page to override or circumvent the permission model Chrome enforces around credential access. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Android, covering all Chrome versions prior to 151.0.7922.72. The vulnerability is Android-specific and does not appear to affect desktop Chrome builds based on the advisory title referencing a 'stable channel update for desktop' that coincidentally patches this Android-affecting issue.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On managed Android fleets, administrators should enforce Chrome version policy via MDM (e.g., Google Workspace endpoint management or Microsoft Intune) to push the update. As a compensating control where immediate patching is not possible, disabling Chrome's built-in password manager and redirecting users to a standalone password manager app removes the vulnerable component from the attack surface, though this disrupts autofill workflows. Restricting access to untrusted web content via URL filtering or Safe Browsing enforcement reduces exposure to crafted HTML pages required to trigger the vulnerability.