What is the CVSS score of CVE-2026-17955?

CVE-2026-17955 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17955?

Yes, a patch is available for CVE-2026-17955. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17955

EUVD-2026-50881 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-f9pc-prxf-vqp6

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page, no privileges needed, mandatory user interaction; impact limited to integrity via spoofed UI with no C or A consequences.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:35 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.

Technical ContextAI

The vulnerability exists within the Payments subsystem of Chromium, the open-source engine underpinning Google Chrome. CWE-20 (Improper Input Validation) is the root cause class: the browser fails to adequately sanitize or validate attacker-controlled input before rendering it inside payment UI surfaces, enabling spoofed dialogs or altered visual context. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome versions across platforms are in scope until the fix boundary. Notably, the intelligence tags include 'XSS,' suggesting the injection mechanism may involve script- or markup-level manipulation of the Payments UI - though the vendor describes the impact as UI spoofing rather than full cross-site scripting in the traditional document-context sense. The Chromium issue tracker reference (https://issues.chromium.org/issues/517385072) may contain additional technical detail but is typically restricted pre-disclosure.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, as detailed in the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For consumer endpoints, Chrome's built-in silent auto-updater will apply this fix without user action; users can confirm by navigating to chrome://settings/help. Enterprise administrators using Chrome Browser Cloud Management or group policy should verify forced update propagation and check fleet version compliance via their management console. If a controlled rollout delays patching, a compensating measure is to educate users to treat unexpected in-browser payment prompts with suspicion and complete payments only through known-legitimate merchant sites; however, this does not eliminate the technical exposure and is not a substitute for patching. No configuration-level workaround to disable the vulnerable Payments component without broad functional impact has been identified from available data.