What is the CVSS score of CVE-2026-17882?

CVE-2026-17882 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17882?

Yes, a patch is available for CVE-2026-17882. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17882

EUVD-2026-50631 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-g3c9-mhvm-x87q

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Site isolation bypass crosses origin process boundaries implying S:C; extension install requires active user action (UI:R, PR:N); C:L added since cross-origin access likely exposes some data.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:37 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.

Technical ContextAI

CWE-693 (Protection Mechanism Failure) identifies the root cause as an incomplete or bypassable enforcement of Chrome's extension policy controls. Chrome's site isolation architecture separates web origins into distinct renderer processes as a core defence against cross-site attacks such as Spectre and cross-origin data leakage. The Extensions API grants installed extensions elevated access to browser internals and tab content; when policy guards on that API are insufficient, a crafted extension can bridge isolated renderer processes and access origins it should not reach. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop versions prior to 151.0.7922.72, with the issue tracked internally at Chromium issue 523637452 (currently access-restricted per standard disclosure practice).

RemediationAI

The primary fix is to update Google Chrome to version 151.0.7922.72 or later, available through Chrome's built-in auto-update mechanism or directly via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments that cannot immediately deploy the update, the most targeted compensating control is enforcing a Chrome Enterprise extension allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies, which prevents installation of any extension not explicitly approved - this directly eliminates the required attack precondition. The trade-off is operational overhead of maintaining the allowlist and potential friction for users who rely on unvetted extensions. Disabling developer mode sideloading via DeveloperToolsAvailability policy removes another installation vector. Generic network-layer controls are not applicable here, as the vulnerability is triggered post-installation.