What is the CVSS score of CVE-2026-17852?

CVE-2026-17852 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17852?

Yes, a patch is available for CVE-2026-17852. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17852

EUVD-2026-50601 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-2pp4-fggf-q8fx

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N), no privileges needed (PR:N), user navigation required (UI:R); Media Router flaw enables cross-origin integrity violation but not data disclosure or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:35 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.

Technical ContextAI

The vulnerability resides in Chrome's Media Router subsystem, the component responsible for facilitating communication with cast-compatible devices (e.g., Chromecast endpoints) and handling media routing requests across browser contexts. CWE-346 (Origin Validation Error) identifies the root cause class: the implementation fails to properly validate the origin of requests or messages processed by the Media Router, allowing a cross-origin HTML page to issue interactions that should be restricted to the same-origin context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop installations prior to the fixed build are in scope. This class of flaw is consistent with browser IPC or Mojo interface misuse, where insufficient origin checks on privileged browser-process-side handlers allow renderer-process content from a foreign origin to trigger protected operations.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most desktop Chrome installations update automatically; administrators managing enterprise fleets should verify rollout via Google Admin Console or equivalent MDM tooling. As a compensating control pending patch deployment, organizations may consider disabling or restricting access to Media Router features via Chrome enterprise policy (e.g., EnableMediaRouter=false), though this will disable Chromecast and related casting functionality - a trade-off relevant only for environments that do not rely on media casting. Restricting users to known-safe browsing lists via web proxy can reduce exposure to crafted attacker-controlled pages but is not a substitute for patching.