What is the CVSS score of CVE-2026-17954?

CVE-2026-17954 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17954?

Yes, a patch is available for CVE-2026-17954. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17954

EUVD-2026-50880 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-2qf8-w85f-8mmv

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Victim must open a crafted MHTML file (UI:R); no auth required (PR:N); impact limited to partial cross-origin read (C:L), no write or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:42 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.

Technical ContextAI

MHTML (MIME Encapsulation of Aggregate HTML Documents, RFC 2557) is a single-file web archive format supported by Chrome for saving and opening web pages locally. The vulnerability is rooted in CWE-346 (Origin Validation Error), meaning Chrome's MHTML handler fails to correctly enforce the Same-Origin Policy when processing a specially crafted MHTML document, allowing content within the archive to read data from a different origin than its own. The affected component is the core Chrome browser application (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) across all platforms, in all versions preceding 151.0.7922.72. This class of flaw typically arises when archive-format parsers assign an overly permissive or incorrect origin context to embedded resources, bypassing standard browser isolation mechanisms.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. The update is available through Chrome's built-in auto-update mechanism or can be triggered manually via chrome://settings/help. The release advisory is at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In environments where immediate patching is constrained, a compensating control is to restrict or disable MHTML file handling by configuring file association policies to prevent Chrome from opening .mht or .mhtml files - this eliminates the attack vector at the cost of losing the MHTML save/open functionality. Enterprise deployments using Chrome Browser Cloud Management or group policy can enforce the minimum version via the ChromeVersion policy to ensure fleet-wide compliance.