What is the CVSS score of CVE-2026-17843?

CVE-2026-17843 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17843?

Yes, a patch is available for CVE-2026-17843. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17843

EUVD-2026-50592 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-7g7q-x3jc-wh3x

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Web-delivered payload requires victim navigation (UI:R, PR:N); limited cross-origin data exposure only with no integrity or availability impact (C:L, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:46 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.

Technical ContextAI

The vulnerability resides in Google Chrome's CSS implementation and is rooted in CWE-346 (Origin Validation Error), a class of flaws where software fails to properly enforce origin boundaries when processing or rendering resources. CSS features such as cross-origin font metric inference, computed style side-channels, or CSS custom property leakage have historically enabled browsers to inadvertently expose information about cross-origin resources, bypassing the Same-Origin Policy at the rendering layer rather than at the network layer. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/518103887) may contain further technical detail but its public accessibility is not confirmed from available data.

RemediationAI

The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this to most end-user systems automatically; enterprise environments using managed deployment (Google Admin Console, SCCM, Intune) should push the update through their standard patch pipeline. As a compensating control where immediate patching is not possible, enforcing strict Content Security Policy headers (particularly frame-ancestors and default-src restrictions) on sensitive web properties can reduce the attack surface by limiting cross-origin interactions at the application layer, though this does not eliminate the CSS-layer leak within Chrome itself and is not a substitute for patching. No workarounds that fully mitigate the underlying CSS origin validation flaw are available without applying the vendor patch.