What is the CVSS score of CVE-2026-17904?

CVE-2026-17904 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17904?

Yes, a patch is available for CVE-2026-17904. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17904

EUVD-2026-50653 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-c25g-9fj6-6fw6

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML page with no auth needed; user must actively visit the page; only partial confidentiality impact from cross-origin data leak, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:45 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.

Technical ContextAI

The flaw is classified as CWE-346 (Origin Validation Error), meaning the browser fails to correctly enforce its same-origin policy for a specific subsystem - in this case, the Web NFC API available on Android. The Web NFC API provides JavaScript access to NFC tag reading and writing on supported Android devices; Chrome is expected to gate cross-origin access through strict policy checks. The insufficient enforcement allows policy to be sidestepped, permitting a page to read data that should be restricted to a different origin. The affected codebase is Google Chrome (CPE: cpe:2.3:a:google:chrome) on Android, versions prior to the 151.0.7922.72 stable release. This is a browser-layer policy bug, not an NFC hardware or OS vulnerability.

RemediationAI

The primary fix is to update Google Chrome for Android to version 151.0.7922.72 or later, as detailed in the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The patch is confirmed available from the vendor per advisory and EUVD data. For organizations unable to deploy the update immediately, compensating controls include restricting access to untrusted or external web content on managed Android devices via Mobile Device Management (MDM) policy, and disabling NFC at the device level where NFC functionality is not required - though disabling NFC system-wide is disruptive to contactless payment and other NFC-dependent workflows. Given the low severity and absence of active exploitation, urgent emergency patching is not warranted; inclusion in the next standard Chrome update cycle is appropriate for most environments.