What is the CVSS score of CVE-2026-17960?

CVE-2026-17960 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17960?

Yes, a patch is available for CVE-2026-17960. Update the affected software to the latest version immediately.

Chrome for iOS CVE-2026-17960

EUVD-2026-50886 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-3gjj-5f84-j9q6

Authentication Bypass Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Referrer leak is a confidentiality impact (C:L), not integrity; no integrity or availability consequence applies to the vulnerable system.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:37 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.

Technical ContextAI

CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: the browser - acting as the enforcement agent for server-defined policy - fails to honour the no-referrer directive when processing a maliciously crafted HTML page. The Referrer-Policy: no-referrer HTTP header instructs browsers to suppress the Referer request header on outbound navigations; when Chrome for iOS mishandles this policy, the full or partial URL of the originating page is transmitted to a third-party destination. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering versions on iOS prior to 151.0.7922.72. This is an iOS-specific code path divergence from Chromium's desktop policy-enforcement logic, as the Chrome Releases advisory targets the iOS stable channel specifically.

RemediationAI

Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. The vendor-released patch is confirmed available per the Chrome stable channel update advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at issues.chromium.org/issues/517631680. If immediate update is not possible, site operators relying on no-referrer policy for privacy guarantees should consider adding the rel='noreferrer' attribute directly to anchor tags as a belt-and-suspenders measure, as this attribute is honoured at the HTML level and may be less susceptible to the browser-level policy bypass. Note this workaround requires modifying outbound links on the site, not a client-side fix. Users on iOS should ensure automatic app updates are enabled to receive the patch without manual intervention.