What is the CVSS score of CVE-2026-17879?

CVE-2026-17879 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17879?

Yes, a patch is available for CVE-2026-17879. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17879

EUVD-2026-50628 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-24c5-cm69-pxc3

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via crafted page requiring no authentication, but passive user navigation is mandatory; impact is partial cross-origin data disclosure only, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:54 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.

Technical ContextAI

CWE-346 (Origin Validation Error) indicates the Chrome Autofill engine does not correctly validate that data surfaced or triggered by a page originates from-or is scoped to-the same origin as the requesting document. The Autofill subsystem interacts with form fields and browser-stored credentials/payment data across page contexts; a failure in origin gating can allow a cross-origin page to observe Autofill-populated values or trigger their disclosure indirectly. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms (Windows, macOS, Linux, ChromeOS) prior to the fixed build. Chromium issue tracker reference 522878450 was filed internally and is the upstream bug driving this fix.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update Chrome via Settings > Help > About Google Chrome or through enterprise deployment tooling (Google Admin Console, Intune, etc.). The stable channel update advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate upgrade is not possible, disabling the Autofill feature for forms and passwords (chrome://settings/autofill) removes the vulnerable code path at the cost of convenience-Autofill suggestions will no longer populate, requiring manual entry. Restricting access to untrusted external websites via network policy or DNS filtering is a secondary control that reduces exposure surface but does not eliminate the vulnerability for pages that bypass perimeter controls.