What is the CVSS score of CVE-2026-17872?

CVE-2026-17872 has a contested CVSS base score of 6.1 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17872?

Yes, a patch is available for CVE-2026-17872. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17872

EUVD-2026-50621 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-30 Chrome

GHSA-3p38-7q3j-hw9h

Information Disclosure Google Jwt Attack

Medium

Disputed · 6.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Local vector confirmed by description; PR:N because no device credentials needed, only local presence; S:C reflects sandbox escape crossing security boundary; UI:R for required user interaction with crafted HTML.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:37 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.1

DescriptionCVE.org

Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.

Technical ContextAI

WebAppInstalls is the Chrome subsystem responsible for Progressive Web App (PWA) installation workflows on Android, handling HTML parsing, manifest processing, and associated cryptographic operations. A flaw in cryptographic logic within this component - CWE not formally assigned in available data - allows a crafted HTML page to produce an unexpected security-boundary crossing. The CVSS S:C (Scope Changed) metric confirms the exploit escapes the Chromium renderer sandbox and gains influence over the broader Android process space. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* narrowed by EUVD to all Chrome versions below 151.0.7922.72. Because CWE is listed as N/A, the precise cryptographic weakness class (e.g., broken algorithm, incorrect key handling, nonce reuse) cannot be confirmed from available data.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store; this is the vendor-confirmed patched release per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate update is not possible, a practical compensating control is to avoid opening untrusted HTML pages or installing PWAs from unverified sources, which removes the UI:R trigger condition; this limits functionality but reduces exposure. Disabling PWA installation (if manageable via enterprise policy through Chrome browser cloud management) would remove the WebAppInstalls attack surface entirely, though this eliminates PWA support. There is no indication that network-level controls would mitigate this vulnerability given the local attack vector.