What is the CVSS score of CVE-2026-17934?

CVE-2026-17934 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17934?

Yes, a patch is available for CVE-2026-17934. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17934

EUVD-2026-50860 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-rcf3-4779-3g67

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered crafted page requires active user visit (UI:R); navigation bypass yields integrity-only impact with no confidentiality, availability, or scope-change effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:34 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.

Technical ContextAI

The affected component is Chrome's built-in DevTools - the developer tooling accessible via F12 or right-click inspect - which processes HTML and script input from the active browsing context. CWE-20 (Improper Input Validation) identifies the root cause as a failure to adequately sanitize untrusted data before it influences navigation logic within DevTools. Navigation restrictions in browser contexts include same-origin policy enforcement, sandboxing constraints, and URL filtering; a bypass in this layer could allow a crafted page to redirect frames or windows to otherwise-restricted origins. The unchanged scope (S:U) in the CVSS vector indicates the flaw is contained within the browser's own security boundary rather than escaping the sandbox. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with an upper-exclusive bound of 151.0.7922.72 confirms all prior stable versions across Windows, macOS, and Linux are affected.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed fix per the stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Updates can be applied via Settings > Help > About Google Chrome or through enterprise deployment tools (Google Admin Console, WSUS-integrated packaging). If immediate patching is not feasible in managed environments, restricting DevTools access via the Chrome enterprise policy DevToolsAvailability=Disabled (set to value 2) eliminates the specific attack surface for this component; note this will block legitimate developer workflows and may affect internal tooling that relies on DevTools APIs. No workaround fully substitutes for the patch, as the crafted HTML page delivery vector does not require DevTools to be explicitly opened by the user in all exploitation scenarios.