What is the CVSS score of CVE-2026-17963?

CVE-2026-17963 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17963?

Yes, a patch is available for CVE-2026-17963. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17963

EUVD-2026-50889 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-qv2f-7gph-gxx4

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring passive user visit; no privileges needed; only limited confidentiality impact (cross-origin data leak); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.

Technical ContextAI

The vulnerability resides in Chrome's SVG (Scalable Vector Graphics) rendering engine and is classified as CWE-346 (Origin Validation Error). SVG natively supports cross-origin resource references through elements such as image, use, and filter primitives that can fetch or render content from external origins. When origin boundary enforcement is implemented incorrectly, crafted SVG markup can cause the browser to expose pixel-level or metadata-level information from cross-origin resources back to the embedding page, effectively bypassing the Same-Origin Policy. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome desktop releases on Windows, macOS, and Linux prior to the 151.0.7922.72 stable channel update. The Chromium bug tracker issue 517759257 is referenced but likely restricted, so the precise code path triggering the flaw has not been publicly disclosed.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism typically applies this silently; users can force an immediate update via chrome://settings/help. Enterprise administrators managing Chrome at scale via Google Admin Console or endpoint management tools (e.g., Intune, JAMF) should push version 151.0.7922.72 to all managed endpoints. No workaround is necessary given confirmed patch availability, but organizations with high-sensitivity environments may temporarily restrict end-user navigation to untrusted external sites via DNS filtering or proxy policy to reduce exposure until patching is confirmed complete.