What is the CVSS score of CVE-2026-17873?

CVE-2026-17873 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17873?

Yes, a patch is available for CVE-2026-17873. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17873

EUVD-2026-50622 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-h989-9wh8-qq8f

Google Apple Authentication Bypass Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML with no privileges required; user must visit the page (UI:R); impact is integrity-only DAC bypass with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:36 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page remotely

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

Victim opens page in Chrome for iOS

Execution

Insufficient policy enforcement triggered

Persist

Discretionary access control bypass achieved

Impact

Unauthorized integrity modification occurs

Access

Host crafted HTML page remotely

Delivery

Deliver link to iOS Chrome user via phishing

Exploit

Victim opens page in Chrome for iOS

Execution

Insufficient policy enforcement triggered

Persist

Discretionary access control bypass achieved

Impact

Unauthorized integrity modification occurs

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome (not Safari or another browser) on an iOS device with Chrome prior to version 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects a network-reachable, low-complexity attack requiring one click from the victim, with high integrity impact but no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and serves a crafted HTML page designed to trigger Chrome for iOS's insufficient policy enforcement code path. The attacker sends a phishing link via email, SMS, or social media to a target iOS user. …
Remediation	Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. … Detailed patch versions, workarounds, and compensating controls in full report.