What is the CVSS score of CVE-2026-17945?

CVE-2026-17945 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17945?

Yes, a patch is available for CVE-2026-17945. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17945

EUVD-2026-50871 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-g28r-c3hv-v5r3

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

AC:H assigned because exploitation requires a pre-compromised renderer process, making this an inherently chained, high-complexity attack; all other metrics follow the description and official vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

2.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:36 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.

Technical ContextAI

CWE-451 (UI Misrepresentation of Critical Information) identifies the root cause as insufficient validation of untrusted input originating from the renderer process within Chrome's Navigation subsystem. Chrome's multi-process architecture is designed so that the browser process enforces trust boundaries over renderer-supplied content; this flaw allows a compromised renderer to bypass those controls and manipulate navigation-layer UI elements such as the address bar or security indicators. The affected software is Google Chrome across all platforms prior to build 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The Navigation component bridges the sandbox boundary between renderer and browser, making validation failures here particularly sensitive to trust-boundary confusion.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later as confirmed by the Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's automatic update mechanism will deliver this patch to most consumer endpoints without user action; enterprise administrators using managed policies (Google Admin Console, GPO, or MDM) should verify that update channels are not restricted and that the 151.0.7922.72 build has been pushed to all managed devices. No standalone workaround exists for the spoofing behavior itself, as it operates at the renderer-browser trust boundary; however, because exploitation first requires renderer compromise via a separate vulnerability, maintaining a fully patched Chrome installation eliminates the prerequisite attack surface and thus transitively mitigates this flaw. Additional Chromium technical details are tracked at https://issues.chromium.org/issues/514519203.