What is the CVSS score of CVE-2026-17943?

CVE-2026-17943 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17943?

Yes, a patch is available for CVE-2026-17943. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17943

EUVD-2026-50869 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-g85x-23c8-c98w

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network delivery with no privileges required, but UI:R is mandatory; integrity-only impact reflects CSP bypass without data exfiltration or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:38 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.

Technical ContextAI

The flaw resides in Google Chrome's HTML parser and is classified under CWE-693 (Protection Mechanism Failure), meaning a security control - specifically the browser's enforcement of Content Security Policy headers - is not correctly applied due to an implementation defect in parsing logic. CSP is a critical browser-enforced defense against cross-site scripting (XSS) and data injection attacks by restricting which scripts, styles, and resources a page may load. An 'inappropriate implementation' in the parser means certain HTML constructs are processed in a way that the engine fails to honor the page's declared CSP directives. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to the patched release 151.0.7922.72. The Chromium issue tracker reference (issues.chromium.org/issues/514424283) contains additional technical detail but may require access.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, the patched stable channel release confirmed by the vendor advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, but administrators should verify deployment via chrome://settings/help or Chrome Browser Cloud Management. If patching is delayed, compensating controls include server-side hardening of CSP headers using nonces or strict-dynamic directives, which reduces reliance on browser-side CSP enforcement alone - note that this mitigates downstream XSS risk rather than the parser bug itself and may require application-level changes. Organizations should also consider enabling Safe Browsing Enhanced Protection to reduce the likelihood of users reaching attacker-controlled pages.