What is the CVSS score of CVE-2026-17873?

CVE-2026-17873 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17873?

Yes, a patch is available for CVE-2026-17873. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17873

EUVD-2026-50622 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-h989-9wh8-qq8f

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML with no privileges required; user must visit the page (UI:R); impact is integrity-only DAC bypass with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:36 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.

Technical ContextAI

CWE-284 (Improper Access Control) classifies this as a failure to correctly enforce access policies rather than a memory-safety issue. Chrome for iOS is architecturally distinct from desktop Chrome: Apple's App Store policies require third-party browsers on iOS to use the WebKit rendering engine, so Chrome for iOS wraps WebKit with its own policy and permission layers. The vulnerability lies in those Chrome-specific iOS policy enforcement layers - a crafted HTML page can trigger a code path that bypasses discretionary access control (DAC) checks that would otherwise restrict resource or capability access. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the iOS scope is narrowed by the CVE description and advisory context rather than the CPE itself.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. This is the vendor-released patch confirmed by the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Automatic updates should apply this fix on most iOS devices when connected to Wi-Fi; manually trigger the update in the App Store if auto-updates are disabled. If immediate patching is not possible, consider restricting access to untrusted web content through Mobile Device Management (MDM) URL filtering policies, though this reduces browser functionality. No workaround is documented by the vendor that preserves full browser functionality while mitigating the flaw.