What is the CVSS score of CVE-2026-17842?

CVE-2026-17842 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17842?

Yes, a patch is available for CVE-2026-17842. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17842

EUVD-2026-50591 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-8737-76mx-jgwh

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page; no privileges needed; mandatory user gesture interaction (UI:R); integrity high for SOP bypass; no confidentiality or availability impact evident.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:39 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.

Technical ContextAI

CWE-346 (Origin Validation Error) describes failures in properly verifying the origin of a message or request before acting on it. In this case, an 'inappropriate implementation' within Chrome's iOS-specific codebase mishandles origin validation when the user performs specific UI gestures-likely swipe, tap, or drag interactions that Chrome for iOS interprets differently from the desktop engine. This creates a pathway for a crafted page to sidestep the Same-Origin Policy (SOP), the foundational browser security boundary preventing one origin from reading or modifying resources belonging to another. The CPE cpe:2.3:a:google:chrome:* encompasses all Chrome variants, but the description and context narrow the affected surface to the iOS platform specifically, where the Blink/WebKit rendering integration differs from desktop builds. The ENISA EUVD entry (EUVD-2026-50591) corroborates the version boundary at 151.0.7922.72.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, organizations can advise iOS users to avoid visiting untrusted or unfamiliar web pages and to be cautious of pages that prompt them to perform unusual tap, swipe, or gesture interactions-the specific UI actions exploitable in this flaw. Restricting access to sensitive authenticated web applications from unpatched iOS Chrome builds is a secondary mitigation with low operational overhead. No workaround eliminates the root cause; the patch is the only confirmed remediation.