What is the CVSS score of CVE-2026-17905?

CVE-2026-17905 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17905?

Yes, a patch is available for CVE-2026-17905. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17905

EUVD-2026-50654 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-49r7-m76h-55w7

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

AV:N and PR:N as attacker only needs victim to visit a page; UI:R for required victim navigation; C:L for partial cross-origin data leakage with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:44 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.

Technical ContextAI

SurfaceCapture is a Chromium subsystem related to screen or surface content rendering and capture. CWE-346 (Origin Validation Error) identifies the root cause as a failure to correctly validate or enforce the browser's same-origin policy within this subsystem - specifically, the implementation allows cross-origin data to escape the security boundary that should isolate web content from different origins. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all desktop Chrome versions prior to 151.0.7922.72. This class of flaw is particularly sensitive in browsers because the same-origin policy is a foundational security primitive underpinning web isolation.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, as detailed in the official stable channel release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's auto-update mechanism will deliver this fix automatically for most users; verifying the installed version under chrome://settings/help and restarting the browser ensures the update is applied. For enterprise environments managed via group policy or MDM, push version 151.0.7922.72 through the relevant fleet management tooling. No documented workarounds exist; the only confirmed remediation is upgrading to the patched release. Given the low EPSS and absence of active exploitation, this fix can be incorporated into the standard patching cycle rather than requiring emergency deployment.