What is the CVSS score of CVE-2026-17919?

CVE-2026-17919 has a contested CVSS base score of 6.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17919?

Yes, a patch is available for CVE-2026-17919. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17919

EUVD-2026-50668 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-3g8r-vcv3-r4mg

Privilege Escalation Google

Medium

Disputed · 6.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Physical access is the sole attack vector; no prior system privileges needed; full C/I/A impact post-exploitation with no scope change.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:33 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

6.8 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.8

DescriptionCVE.org

Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome Enterprise on macOS allows a local attacker with physical device access to bypass enterprise policy controls and gain elevated privileges. Affected are all Chrome versions prior to 151.0.7922.72 in managed Enterprise deployments on Mac. The attack requires physical presence at the target device, substantially limiting the threat surface, though the confidentiality, integrity, and availability impact is rated high once exploited. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-693 (Protection Mechanism Failure) - specifically, insufficient enforcement of Enterprise policy controls within Google Chrome on macOS. Chrome Enterprise allows organizations to push managed policies governing browser behavior, feature access, and system integration via MDM or group policy. A failure in policy enforcement at the macOS platform layer means that a locally present attacker can circumvent these restrictions and escalate privileges, likely exploiting the gap between Chrome's policy parsing/application and the underlying macOS privilege model. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions before 151.0.7922.72 on Mac.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this vulnerability. Enterprise administrators should ensure managed Mac endpoints are updated through their MDM or Chrome Browser Cloud Management console. The vendor advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control where immediate patching is not possible, organizations should enforce physical security measures - screen locking policies, BIOS/EFI passwords, and restricted physical access to managed Mac devices - to deny the physical presence prerequisite. Disabling unattended or kiosk-style deployments of unpatched Chrome instances on macOS would further reduce exposure. These controls carry minimal operational trade-offs in typical enterprise environments.