What is the CVSS score of CVE-2026-17840?

CVE-2026-17840 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17840?

Yes, a patch is available for CVE-2026-17840. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17840

EUVD-2026-50589 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-rw9v-fqfw-2qxc

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page, no privileges needed, user must interact; integrity high due to credential misdirection; no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:39 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's Passwords UI fails to correctly display or validate the security origin when rendering certain crafted HTML constructs, breaking the browser's trust boundary between domains. The affected component is the built-in Chrome password manager - not a third-party extension - which relies on accurate domain attribution to correctly autofill, save, or prompt for credentials. When this domain signal is spoofed at the UI layer, users may save credentials against a malicious origin or be misled about which domain a password prompt belongs to. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome browser versions across platforms prior to the fixed 151.0.7922.72 release. The Chromium security team rated this Medium severity internally.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed fixed release documented in the Chrome stable channel update at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, so ensuring the auto-update mechanism is not disabled is the primary action for most users and administrators. As a compensating control for environments where immediate patching is delayed, security teams can disable Chrome's built-in password manager via enterprise policy (PasswordManagerEnabled=false) and redirect users to a separately managed password manager - note this disrupts user workflow and may lead to weaker credential hygiene. User awareness guidance around verifying domain indicators before accepting password save/autofill prompts can reduce exploitation likelihood in the interim.