What is the CVSS score of CVE-2026-17859?

CVE-2026-17859 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17859?

Yes, a patch is available for CVE-2026-17859. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17859

EUVD-2026-50608 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-07-30 Chrome

GHSA-x52f-23v9-fg5g

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges needed, victim visit required; impact limited to partial cross-origin data disclosure with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:53 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Victim navigates to attacker-controlled URL

Exploit

Chrome favicon subsystem initiates cross-origin favicon fetch

Execution

Side-channel exposes cross-origin resource state

Impact

Attacker script reads leaked data

Access

Attacker crafts malicious HTML page

Delivery

Victim navigates to attacker-controlled URL

Exploit

Chrome favicon subsystem initiates cross-origin favicon fetch

Execution

Side-channel exposes cross-origin resource state

Impact

Attacker script reads leaked data

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome prior to version 151.0.7922.72 on a desktop platform and must actively navigate to an attacker-controlled web page - passive drive-by exploitation without any page load is insufficient (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS score of 4.3 (Medium) is internally consistent: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), but user interaction is mandatory (UI:R) and impact is limited to partial confidentiality loss (C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page designed to trigger Chrome's favicon loading mechanism in a manner that reveals whether specific cross-origin resources exist or have been previously loaded in the victim's browser session. When a victim visits the page using an unpatched Chrome version, the browser's favicon subsystem leaks limited cross-origin state back to the attacker's page through a side-channel. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch. … Detailed patch versions, workarounds, and compensating controls in full report.