What is the CVSS score of CVE-2026-17876?

CVE-2026-17876 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17876?

Yes, a patch is available for CVE-2026-17876. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17876

EUVD-2026-50625 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-6frp-279q-xv29

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring victim navigation (UI:R); no attacker authentication; impact limited to partial cross-origin confidentiality leak with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:53 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.

Technical ContextAI

The vulnerability resides in Google Chrome's Payments component - most likely the Payment Request API or adjacent payment-handling logic - across all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). CWE-346 (Origin Validation Error) identifies the root cause class: the Payments subsystem fails to properly enforce origin boundaries when processing or responding to payment-related requests, allowing data belonging to one origin to be read by a script executing under a different origin. The same-origin policy (SOP) is the browser's foundational isolation mechanism; an 'inappropriate implementation' in a feature-specific subsystem like Payments can introduce a localized bypass even when the broader SOP enforcement is intact. The Chromium bug tracker reference (issues.chromium.org/issues/522425471) is the upstream tracking issue, reported by the Chrome team itself.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update all Chrome installations to version 151.0.7922.72 or later per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify propagation via Chrome Browser Cloud Management or Group Policy and confirm the installed version reaches 151.0.7922.72. As a compensating control where immediate patching is constrained, restricting browser access to untrusted external pages via web proxy or DNS filtering reduces exposure but carries significant usability trade-offs. Organizations that do not use web-based payment flows could evaluate disabling the Payment Request API through Chrome enterprise policy, though this will break legitimate payment UI on affected sites. Neither workaround substitutes for patching.