What is the CVSS score of CVE-2026-17830?

CVE-2026-17830 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17830?

Yes, a patch is available for CVE-2026-17830. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17830

EUVD-2026-50579 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-26r8-m29g-9h7p

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page with no privileges; user must click link; impact is integrity-only as navigation restrictions are bypassed, with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:36 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability is rooted in CWE-284 (Improper Access Control), classified by Chromium as an 'inappropriate implementation' within Chrome's iOS navigation layer. Chrome for iOS uses Apple's WebKit rendering engine (mandated by Apple's App Store policies) but wraps it in Chromium's own navigation and security logic; the flaw likely lies in how Chrome's navigation controller enforces origin or scheme restrictions that differ from or conflict with the underlying WebKit behavior on iOS. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the EUVD narrowing scope to all Chrome for iOS builds below version 151.0.7922.72. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-delivered, requires no privileges, and results exclusively in an integrity impact - consistent with a navigation policy bypass rather than memory corruption or data exfiltration.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 for iOS. Users should update Chrome on their iPhone or iPad to version 151.0.7922.72 or later via the Apple App Store immediately, as the patch is confirmed available per the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS devices through MDM solutions (e.g., Jamf, Microsoft Intune) should push a managed app update policy to enforce the minimum Chrome version. As a compensating control prior to patching, restricting end users from browsing untrusted or external URLs in Chrome for iOS - for example, by enforcing managed browser policies that limit navigation to corporate-approved domains - would reduce exposure, though this may impact legitimate browsing workflows. There is no workaround that fully substitutes for the patch.