What is the CVSS score of CVE-2026-17939?

CVE-2026-17939 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17939?

Yes, a patch is available for CVE-2026-17939. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17939

EUVD-2026-50865 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-c59g-pfwx-wvf7

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network vector, no privileges needed, but active user interaction required; impact is limited to low integrity (UI spoofing only) with no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:31 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.

Technical ContextAI

The vulnerability resides in Chrome's built-in Passwords component - the credential storage, autofill, and password save/fill prompt subsystem. CWE-20 (Improper Input Validation) identifies the root cause: the component fails to sufficiently validate untrusted data received over the network before using it to render password-related UI elements, such as credential save prompts or autofill suggestions. This class of flaw allows attacker-controlled values to influence what the user sees in these UI surfaces, potentially fabricating convincing but deceptive credential dialogs. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72 across all platforms.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the vendor-confirmed fix version documented in the stable channel release advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome applies updates automatically for most consumer deployments, but enterprise administrators managing Chrome via group policy or endpoint management platforms (such as Google Admin console or third-party MDM) should verify successful rollout using version reporting. If immediate patching is delayed, risk can be partially mitigated by instructing users not to interact with unexpected password save or autofill prompts on untrusted networks, and by enforcing HTTPS-only browsing policies to reduce exposure to man-in-the-middle traffic manipulation - though neither control fully eliminates the exposure since HTTPS traffic can still originate from attacker-controlled origins.