What is the CVSS score of CVE-2026-17857?

CVE-2026-17857 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17857?

Yes, a patch is available for CVE-2026-17857. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17857

EUVD-2026-50606 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-cmf5-j3m2-rggm

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring active user visit; only limited cross-origin confidentiality leak with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:50 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.

Technical ContextAI

The vulnerability is rooted in CWE-346 (Origin Validation Error), a class of flaw where software fails to properly verify that a network resource is originating from a trusted origin before granting access. In Chrome's network stack, the Same-Origin Policy (SOP) is a critical security boundary that prevents scripts on one origin from reading data from another. An 'inappropriate implementation' in Chrome's network component (as described by the reporter) allowed this boundary to be circumvented, enabling cross-origin data exfiltration. The affected product is confirmed via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome instances on all platforms prior to 151.0.7922.72. The chromium issue tracker entry (issues.chromium.org/issues/520186620) references the upstream fix.

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which is confirmed as patched per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deploy this for most users; enterprise administrators should verify managed deployments are updated via Google Admin Console or endpoint management tooling. As a compensating control where immediate patching is not feasible, organizations can enforce web filtering or proxy policies to block navigation to untrusted or unknown external URLs, reducing the likelihood of users reaching a crafted HTML page - note this does not eliminate risk for socially engineered links within allowed domains. There are no known configuration-level workarounds to disable the vulnerable network behavior without patching.