What is the CVSS score of CVE-2026-17961?

CVE-2026-17961 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17961?

Yes, a patch is available for CVE-2026-17961. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17961

EUVD-2026-50887 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-q7jh-9642-h43x

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no auth needed (PR:N), requires victim click (UI:R), only low integrity bypass with no C or A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:37 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.

Technical ContextAI

The vulnerability resides in Chrome's Session management layer as implemented on Android, distinct from its desktop counterpart. CWE-284 (Improper Access Control) indicates that the Session component fails to correctly enforce navigation boundary checks, potentially allowing crafted pages to navigate to URLs or application contexts that should be restricted - for example, bypassing same-origin navigation guards, intent-based navigation controls, or inter-app URL restrictions enforced by Android's intent system. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions before 151.0.7922.72 on Android. This is an Android-exclusive issue; desktop Chrome is not identified as affected by the EUVD or Chromium advisory.

RemediationAI

The vendor-released patch is Chrome 151.0.7922.72 for Android, which resolves this vulnerability. Users should update Chrome on Android to version 151.0.7922.72 or later via the Google Play Store. The patch was announced in the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For environments where immediate updating is not feasible, a compensating control is to restrict browsing on Android Chrome to trusted sites via enterprise policy (ChromeContentUrlsEnabled or URL allowlisting through Android Enterprise), which reduces exposure to crafted HTML pages; however, this significantly limits general browsing utility. No workaround eliminates the root cause - patching is the only definitive remediation.