What is the CVSS score of CVE-2026-17880?

CVE-2026-17880 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17880?

Yes, a patch is available for CVE-2026-17880. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17880

EUVD-2026-50629 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-235q-px9q-3cqv

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Attack delivered via crafted webpage (AV:N/AC:L), victim must visit it (UI:R), no attacker privileges needed (PR:N), impact is limited cross-origin data leak only (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:54 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.

Technical ContextAI

The vulnerability resides in Chrome's Autofill feature - the browser subsystem responsible for automatically populating form fields with saved user data such as addresses and payment details. CWE-346 (Origin Validation Error) identifies the root cause: Autofill fails to properly validate the requesting origin before making data available to a page, allowing a cross-origin crafted HTML document to read data that the Same-Origin Policy should isolate. The affected scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms prior to 151.0.7922.72, as confirmed by EUVD-2026-50629.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch addressing this vulnerability per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should apply this fix automatically for most desktop users; enterprise administrators should verify fleet-wide deployment via Chrome Browser Cloud Management or Group Policy and confirm the installed version through chrome://settings/help. As a compensating control prior to patching, disabling Autofill in Chrome settings (chrome://settings/autofill → turn off 'Save and fill addresses' and 'Save and fill payment methods') eliminates the vulnerable code path at the cost of losing auto-population convenience. Web filtering or proxy controls that block navigation to untrusted or unsolicited HTML pages reduce exposure to the crafted-page delivery vector without requiring configuration changes to Chrome itself.