What is the CVSS score of CVE-2026-17959?

CVE-2026-17959 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17959?

Yes, a patch is available for CVE-2026-17959. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17959

EUVD-2026-50885 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-crwh-8xq9-3q5q

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring victim visit (UI:R, PR:N); impact limited to partial cross-origin data disclosure with no integrity or availability effects.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.

Technical ContextAI

The vulnerability resides in Chrome's network implementation and is classified as CWE-346 (Origin Validation Error), a root cause class where software fails to properly validate or enforce the origin of requests or responses. In browser contexts, this typically manifests as a breakdown in Same-Origin Policy (SOP) or CORS enforcement within the network stack - allowing a malicious page to observe, infer, or directly read response data from a different origin. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 151.0.7922.72. The Chromium bug tracker reference (https://issues.chromium.org/issues/517607890) likely contains technical details but may be access-restricted until broader patch adoption.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch per the Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism handles this for most users; administrators managing enterprise fleets should verify deployment via chrome://settings/help or fleet management tooling and push the update if needed. As a compensating control where immediate patching is blocked, enterprise environments can use browser management policies (e.g., Chrome Enterprise policies via Group Policy or CBCM) to restrict navigation to untrusted external origins, reducing exposure to attacker-controlled HTML pages. This approach reduces usability and is not a substitute for patching. No workaround fully mitigates the flaw without applying the patch.