What is the CVSS score of CVE-2026-17962?

CVE-2026-17962 has a contested CVSS base score of 6.1 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17962?

Yes, a patch is available for CVE-2026-17962. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17962

EUVD-2026-50888 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 Chrome

GHSA-gpxf-958m-6mqp

XSS Google

Medium

Disputed · 6.1 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered attack requires only victim interaction to visit a crafted page; scope change reflects cross-origin UXSS execution with limited confidentiality and integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:38 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

6.1 (None) 6.1 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.1

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.

Technical ContextAI

Blink is the HTML rendering engine embedded in Google Chrome, responsible for parsing and rendering web content and enforcing browser-level security boundaries including the Same-Origin Policy. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: Blink's implementation fails to correctly sanitize or restrict script and HTML injection, enabling UXSS - a privileged variant of cross-site scripting that escapes origin isolation. Unlike reflected or stored XSS, UXSS operates at the browser engine level and can affect any origin loaded in the browser session. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases on all platforms prior to 151.0.7922.72.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, confirmed as the patched release per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in update mechanism should apply this automatically; enterprise administrators using fleet management tools should verify deployment via Chrome Browser Cloud Management or equivalent. As a pre-patch compensating control, web proxy or DNS filtering can block access to untrusted or unknown external domains, reducing drive-by delivery risk - however this limits browsing functionality and does not eliminate the underlying flaw. No patch side effects have been reported in available data.