What is the CVSS score of CVE-2026-17829?

CVE-2026-17829 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17829?

Yes, a patch is available for CVE-2026-17829. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17829

EUVD-2026-50578 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-h7f7-vcph-w379

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no attacker privileges needed (PR:N), user must navigate to the page (UI:R), and impact is limited to partial cross-origin data disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:47 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker-controlled server

Delivery

Lure victim to page via phishing or malvertising

Exploit

Trigger policy bypass in Chrome Passwords component

Execution

Read cross-origin credential or session data

Impact

Exfiltrate leaked data to attacker

Access

Host crafted HTML page on attacker-controlled server

Delivery

Lure victim to page via phishing or malvertising

Exploit

Trigger policy bypass in Chrome Passwords component

Execution

Read cross-origin credential or session data

Impact

Exfiltrate leaked data to attacker

Vulnerability AssessmentAI

Exploitation	The victim must actively visit a crafted HTML page, as confirmed by the CVSS UI:R metric - passive exploitation without user navigation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible vulnerability with low complexity and no required privileges for the attacker, but user interaction (UI:R) is mandatory and the confidentiality impact is limited (C:L), with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that exploits the insufficient origin validation in Chrome's Passwords component - for example, by triggering an autofill interaction or credential lookup that leaks data across an origin boundary into the attacker-controlled page context. The victim visits this page (via phishing link, malicious advertisement, or compromised site) while running an unpatched version of Chrome with the password manager enabled. …
Remediation	The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or direct download from Google. … Detailed patch versions, workarounds, and compensating controls in full report.