What is the CVSS score of CVE-2026-17937?

CVE-2026-17937 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17937?

Yes, a patch is available for CVE-2026-17937. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17937

EUVD-2026-50863 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-9fj4-p85c-9x83

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring victim visit (UI:R); no attacker privileges needed; impact isolated to navigation bypass with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.

Technical ContextAI

The vulnerability resides in DevTools, the built-in developer tooling suite embedded in Google Chrome. DevTools processes HTML and JavaScript inputs for inspection and debugging; insufficient validation of untrusted input in this component (CWE-20 - Improper Input Validation) allows a specially crafted HTML page to bypass navigation restriction logic within DevTools processing. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome builds across platforms prior to version 151.0.7922.72. Navigation restrictions in browser contexts are security boundaries designed to prevent unauthorized cross-origin or privileged navigation, and their bypass can enable attacker-controlled redirections or policy circumvention.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism delivers this patch automatically on most managed and consumer installations; users can manually verify and trigger the update via chrome://settings/help. For enterprise environments where immediate patching is constrained, applying the DevToolsAvailability=Disallow Group Policy setting removes the vulnerable DevTools attack surface entirely, though this disables developer tooling for all users in scope - a trade-off acceptable only in production or non-developer endpoints. No other workaround fully mitigates the vulnerability without patching.