What is the CVSS score of CVE-2026-17871?

CVE-2026-17871 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17871?

Yes, a patch is available for CVE-2026-17871. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17871

EUVD-2026-50620 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-wvwr-3hfj-vc2v

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N); mandatory specific UI gestures required (UI:R); impact limited to low cross-origin data disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:53 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.

Technical ContextAI

The root cause is CWE-346 (Origin Validation Error): Chrome's Passwords component fails to enforce correct origin boundaries during certain UI-driven interactions, allowing data from one origin to be read by a cross-origin attacker-controlled page. This likely manifests in autofill or credential-suggestion logic, where the Passwords subsystem surfaces data based on user UI events without adequately validating the requesting origin. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) spans all desktop platforms. The Chromium issue tracker entry (https://issues.chromium.org/issues/521938924) is the upstream bug report, though access may be restricted pending broader patch adoption. The CVSS vector AV:N/AC:L confirms the attack is delivered over the network with no special conditions beyond the user interaction requirement.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, as released in the stable channel update documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should deliver this automatically; confirm the installed version via chrome://settings/help. Enterprise administrators managing Chrome via group policy or endpoint management platforms (e.g., Google Admin, Intune) should push the 151.0.7922.72 channel update immediately. Prior to patching, a targeted compensating control is to disable Chrome's built-in Passwords/autofill feature under chrome://settings/autofill, which removes the vulnerable component from the attack surface; note this disables credential autofill and may impact productivity. Users should also exercise caution when prompted to interact with UI elements on unfamiliar or untrusted pages.