What is the CVSS score of CVE-2026-17917?

CVE-2026-17917 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17917?

Yes, a patch is available for CVE-2026-17917. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17917

EUVD-2026-50666 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-8hh5-hmcm-cgrx

Authentication Bypass Google Apple

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered crafted HTML requires victim to open the page (UI:R); no attacker privileges needed; integrity-only impact within browser scope with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:36 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.

Technical ContextAI

Chrome for iOS operates under Apple platform restrictions that mandate WebKit as the rendering engine rather than Blink, meaning iOS-specific code paths diverge substantially from desktop Chromium's policy enforcement stack. CWE-284 (Improper Access Control) identifies the root cause as a failure to correctly enforce discretionary access control policies for web content, allowing a crafted HTML page to access or modify resources beyond its permitted scope. The CPE identifier cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome application, and the EUVD (EUVD-2026-50666) confirms the version boundary at 151.0.7922.72. The iOS-specific build introduces unique policy enforcement code separate from desktop Chrome, which is a historically fertile area for platform-specific bypass vulnerabilities. Chromium issue 511816897 references the underlying tracker for additional technical specifics, though full details were not available in provided data.

RemediationAI

The primary fix is to upgrade Google Chrome for iOS to version 151.0.7922.72 or later, delivered via the Apple App Store. The vendor release advisory documenting this fix is available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No documented workarounds specific to this vulnerability exist; as a compensating control prior to patching, users should avoid visiting untrusted or unfamiliar websites in Chrome for iOS and exercise caution with links received via email or messaging, given the UI:R (user interaction required) attack vector. Enabling automatic app updates on iOS ensures the patch is delivered without manual action and reduces the window of exposure on managed and consumer devices alike.