What is the CVSS score of CVE-2026-17883?

CVE-2026-17883 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17883?

Yes, a patch is available for CVE-2026-17883. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17883

EUVD-2026-50632 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-gf76-8fvr-h9hj

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

SOP bypass via crafted HTML requires user or pipeline-triggered page load (UI:R, PR:N); impact is integrity-only (I:H) with no confidentiality, availability, or scope-change consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:37 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.

Technical ContextAI

CWE-346 (Origin Validation Error) identifies the root cause: Chrome's Headless mode fails to correctly enforce the Same-Origin Policy (SOP), the fundamental browser security boundary preventing scripts from one origin from accessing or modifying resources belonging to a different origin. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome releases prior to 151.0.7922.72. Headless Chrome is a server-side, UI-less rendering mode widely used in automated testing pipelines, CI/CD systems, web scraping services, and server-side HTML rendering - contexts where untrusted or semi-trusted HTML input is routinely processed without direct human oversight, making SOP enforcement especially critical.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, as detailed in the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations running Headless Chrome in automated pipelines (CI/CD, scraping, server-side rendering), ensure the updated binary is deployed to all nodes processing HTML input - these environments satisfy UI:R passively and represent the highest-risk deployment pattern. As a compensating control prior to patching, restrict Headless Chrome pipelines to processing only fully trusted, internally generated HTML; adding an allowlist or sandboxing layer around what URLs and HTML sources Headless Chrome is permitted to load reduces the attacker's ability to deliver the crafted page. Note that disabling Headless mode entirely would eliminate the vulnerable code path but would break dependent automation workflows.