What is the CVSS score of CVE-2026-17902?

CVE-2026-17902 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-17902?

Yes, a patch is available for CVE-2026-17902. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17902

EUVD-2026-50651 LOW

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-3wq4-w788-rhg3

Information Disclosure Google

3.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.5 LOW

Network delivery via crafted HTML page justifies AV:N; PR:L reflects authenticated context needed for cross-origin leakage; UI:R for required victim interaction; C:L for limited data exposure only.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:56 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

3.5 (LOW)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

LOW 3.5

DescriptionCVE.org

Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.

Technical ContextAI

The vulnerability resides in Chromium's Editing component - the subsystem responsible for clipboard operations, text selection, drag-and-drop, and contenteditable handling - specifically on the Linux platform. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure to enforce information boundaries: the editing subsystem improperly permits cross-origin data to become observable to an attacker-controlled page, violating the Same-Origin Policy. This is a platform-specific defect; the CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) applies broadly but the description explicitly scopes impact to Linux. The Chromium issue tracker entry (https://issues.chromium.org/issues/497251066) is the upstream reference for the root-cause defect.

RemediationAI

Update Google Chrome on Linux to version 151.0.7922.72 or later via the stable channel, as detailed in the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will apply this for most end users; enterprise deployments using managed policies should confirm the update has propagated. As a compensating control prior to patching, enabling Chrome's Strict Site Isolation (chrome://flags/#enable-site-per-process) can limit cross-origin data exposure by isolating renderer processes per origin, though this may increase memory usage. Given the Low severity, PR:L requirement, and user-interaction dependency, this fix is appropriate for inclusion in the next standard patch cycle rather than emergency deployment.