What is the CVSS score of CVE-2026-17892?

CVE-2026-17892 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17892?

Yes, a patch is available for CVE-2026-17892. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17892

EUVD-2026-50641 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-45j3-mr6f-v6pc

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N, AC:L, PR:N), user must visit page (UI:R), memory read only (C:H, I:N, A:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:45 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.

Technical ContextAI

WebXR is the browser API enabling augmented and virtual reality experiences on the web, built into Chromium-based browsers. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is an inappropriate implementation within the WebXR subsystem that fails to properly isolate or sanitize memory before exposing it, allowing attacker-controlled content to trigger reads of out-of-bounds or uninitialized memory within the Chrome renderer process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to the patched release. The Chromium security team rated this Medium severity internally, consistent with its limited integrity and availability impact.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via chrome://version or fleet management tooling and push the update proactively. The advisory is available at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, consider restricting access to untrusted web content through enterprise browser policy or disabling WebXR API access via the Chrome policy flag WebXRImmersiveArEnabled=false, though this will break legitimate WebXR applications and should be evaluated against operational impact. There is no workaround that eliminates the risk without disabling the affected feature.