What is the CVSS score of CVE-2026-17928?

CVE-2026-17928 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17928?

Yes, a patch is available for CVE-2026-17928. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17928

EUVD-2026-50854 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-w298-fwph-8fhx

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page requires active user visit (UI:R); cross-origin data leak is partial (C:L); no integrity, availability, or scope-change impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:43 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).

Technical ContextAI

The DataTransfer API in Chromium is the browser interface that manages data transferred during drag-and-drop operations and clipboard interactions between web content. An inappropriate implementation in this component permits a crafted page to access data that originates from a different security origin, violating the browser's Same-Origin Policy boundary. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that access controls on the DataTransfer object fail to prevent cross-origin reads under specific conditions. The affected product is Google Chrome as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, all versions prior to 151.0.7922.72 on desktop platforms.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released fix per the stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch automatically in most managed and consumer environments; administrators should verify deployment via policy dashboards. No confirmed workaround is documented. If immediate patching is not possible, reducing exposure to untrusted HTML content (e.g., restricting browsing to allowlisted domains via enterprise policy) would reduce the attack surface, though this has operational trade-offs for general-purpose browsing environments.