What is the CVSS score of CVE-2026-17949?

CVE-2026-17949 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17949?

Yes, a patch is available for CVE-2026-17949. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17949

EUVD-2026-50875 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-w6mp-47pm-392w

Google Information Disclosure

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via web page requires no attacker privileges; active victim navigation mandates UI:R; impact is limited to partial confidentiality disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:56 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes the root cause: the GPU processing pipeline in Chrome's Android renderer reads from memory that has not been properly initialized, exposing residual data. Because GPU memory can retain content from previous rendering contexts, including those belonging to different web origins, this class of bug can violate the Same-Origin Policy and leak fragments of cross-origin page content or resources. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to versions below 151.0.7922.72 on Android. The EUVD entry EUVD-2026-50875 confirms the affected range as any Chrome version below 151.0.7922.72.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The Chromium issue tracker reference https://issues.chromium.org/issues/517000034 contains additional technical detail. For users who cannot immediately update, a compensating control is to avoid visiting untrusted or unfamiliar websites on Android Chrome until the update is applied, as exploitation requires victim-initiated navigation to an attacker-controlled page. There is no known configuration toggle to disable the affected GPU code path without broader GPU acceleration impact.