What is the CVSS score of CVE-2026-17926?

CVE-2026-17926 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17926?

Yes, a patch is available for CVE-2026-17926. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17926

EUVD-2026-50852 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5mjv-hhp3-qvm6

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N); mandatory active user gestures (UI:R); navigation bypass yields integrity impact only with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:40 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Google Chrome's DevTools component - the integrated developer tooling environment accessible in desktop Chrome builds. CWE-20 (Improper Input Validation) identifies the root cause as insufficient sanitization of attacker-supplied input originating from a crafted HTML page, allowing it to influence DevTools behavior in a way that violates Chrome's navigation restrictions. These restrictions normally enforce cross-origin and same-origin navigation policies. DevTools has elevated access to browser internals, making it a meaningful attack surface when input validation lapses. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoping all Chrome desktop variants prior to the patched release.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or through enterprise software management tooling; this is the vendor-confirmed fix per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations unable to patch immediately, enterprise administrators can restrict DevTools availability using the Chrome enterprise policy DevToolsAvailability set to disallow (value 2), which eliminates the vulnerable component's exposure; this carries the trade-off of blocking legitimate developer use. Additionally, user awareness of social engineering attempts involving unexpected UI gesture requests can reduce exploitation likelihood given the mandatory UI:R attack requirement.