What is the CVSS score of CVE-2026-17933?

CVE-2026-17933 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17933?

Yes, a patch is available for CVE-2026-17933. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17933

EUVD-2026-50859 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-jgx6-h6w9-gqh9

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page requires victim interaction (UI:R); impact limited to cross-origin storage read with no integrity, availability, or scope-change consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:42 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.

Technical ContextAI

DOMStorage encompasses the Web Storage API's localStorage and sessionStorage mechanisms, which browsers use to persist key-value data strictly scoped to a given origin. CWE-346 (Origin Validation Error) indicates that Chrome's implementation incorrectly validates or enforces the origin boundary when accessing DOMStorage entries, enabling a cross-origin read. The affected component is the Google Chrome browser itself (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) for all versions preceding 151.0.7922.72. The attack is entirely client-side - the browser is the vulnerable endpoint, not any web server.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which resolves the DOMStorage origin validation flaw as documented in the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this for most consumer deployments; enterprise administrators using managed Chrome deployments (via policy or browser management platforms) should verify version propagation. No documented workaround exists for this specific issue - disabling JavaScript would prevent exploitation but renders most web applications non-functional and is not a practical compensating control. The primary and only recommended remediation is applying the vendor patch.