What is the CVSS score of CVE-2026-17850?

CVE-2026-17850 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17850?

Yes, a patch is available for CVE-2026-17850. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17850

EUVD-2026-50599 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-98h2-vjpc-f4m2

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered SOP bypass needs only user page visit (UI:R, PR:N); integrity-only impact with unchanged scope matches permissions-layer bypass without sandbox escape.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:34 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.

Technical ContextAI

CWE-346 (Origin Validation Error) describes failures in properly verifying that a request or resource originates from an expected and legitimate source. In Chrome's permissions subsystem, the same-origin policy (SOP) is a fundamental browser security boundary that prevents scripts on one origin from reading or modifying resources on a different origin. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers the full Google Chrome browser application across platforms. The vulnerability reflects an 'inappropriate implementation' - not a memory corruption or logic inversion, but a subtly incorrect permission-checking code path that a specially crafted HTML page can trigger. CVSS vector S:U (Unchanged scope) indicates the bypass operates within Chrome's existing security context rather than escaping the browser sandbox entirely.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this in most managed and consumer environments; administrators should verify fleet update compliance via policy tooling. If immediate patching is not feasible, reducing exposure can be achieved by enforcing strict Content Security Policy headers on sensitive web properties to limit the practical impact of a SOP bypass, and by using URL filtering to block navigation to untrusted or newly registered domains. These controls do not eliminate the vulnerability but reduce the likelihood of successful exploitation against high-value targets. No other vendor workarounds are documented in available references.