What is the CVSS score of CVE-2026-17889?

CVE-2026-17889 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17889?

Yes, a patch is available for CVE-2026-17889. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17889

EUVD-2026-50638 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-vv96-3637-6hx3

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-exploitable via crafted page (AV:N, PR:N) but requires user visit (UI:R); uninitialized memory leaks only partial cross-origin data (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:55 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.

Technical ContextAI

The vulnerability resides in Chrome's WebXR implementation - the browser API (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) enabling immersive augmented and virtual reality experiences in-browser. CWE-457 (Use of Uninitialized Variable) identifies the root cause: memory allocated for WebXR operations is consumed before being properly zeroed or populated, leaving residual contents from prior allocations accessible. In a multi-origin browser context, such residual heap or stack data can include fragments of content from other origins, constituting a same-process cross-origin information leak. This class of bug is distinct from memory corruption - no code execution path is implied, only data exposure.

RemediationAI

The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later via the stable channel update documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed enterprise environments where immediate rollout is constrained, disabling WebXR via Chrome enterprise policy (setting WebXRImmersiveArEnabled to false through chrome://policy or GPO) eliminates the vulnerable code path entirely, at the cost of breaking legitimate WebXR/VR web applications for end users. Verifying that Chrome's automatic update mechanism is active and not suppressed by policy is the most operationally efficient mitigation for consumer and lightly-managed deployments.