What is the CVSS score of CVE-2026-17910?

CVE-2026-17910 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17910?

Yes, a patch is available for CVE-2026-17910. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17910

EUVD-2026-50659 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-5362-j574-jwgr

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Attacker delivers exploit via crafted web page over network (AV:N, AC:L, PR:N); victim must visit page (UI:R); impact is limited cross-origin data disclosure only, no integrity or availability effect (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:44 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.

Technical ContextAI

The affected component is Chrome's implementation of the Web NFC API on Android (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). Web NFC exposes the NDEFReader interface to browser-based pages, allowing interaction with NFC tags - a feature exclusive to the Android build of Chrome and not present on desktop platforms. CWE-346 (Origin Validation Error) describes failures to properly verify that a resource or message originates from a trusted source; here, Chrome's NFC subsystem fails to consistently enforce the Same-Origin Policy, allowing a page at one origin to read data attributed to a different origin. This is a policy enforcement gap rather than a memory-safety or parsing flaw, making it exploitable through standard web content without requiring native code execution.

RemediationAI

The primary remediation is to update Google Chrome on Android to version 151.0.7922.72 or later; vendor-released patch 151.0.7922.72 addresses this issue and is available via the Google Play Store or Chrome's built-in auto-update mechanism. The official advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For environments where patching is delayed, disabling NFC at the Android OS level via MDM policy (e.g., through Android Enterprise restrictions) eliminates the attack surface entirely, with the trade-off of blocking all NFC functionality including legitimate Web NFC and device-level NFC use cases. Applying a Chrome Enterprise feature policy to disable the Web NFC API (via the WebNfcEnabled policy set to false) is a more targeted compensating control with the narrower trade-off of blocking only browser-based NFC interactions while preserving system-level NFC. Preventing users from browsing untrusted origins is impractical as a standalone control.