What is the CVSS score of CVE-2026-17964?

CVE-2026-17964 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17964?

Yes, a patch is available for CVE-2026-17964. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17964

EUVD-2026-50890 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-whg4-p9v6-fwjh

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered UI spoofing requiring one user click; integrity-only impact limited to misleading security indicator display with no data exposure or service disruption.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:38 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.

Technical ContextAI

CWE-451 describes a class of vulnerabilities where security-critical UI elements - such as address bar domain display, lock icon rendering, or SSL indicator behavior - are rendered inaccurately, misleading the user about the true origin of content. On Android, Chrome's compact UI and limited screen real estate create additional surface for origin-confusion bugs compared to desktop variants. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions on the Android platform prior to 151.0.7922.72. The Chromium project independently rated this Low severity, consistent with the integrity-only CVSS impact. The root cause is in Chrome's security UI rendering layer rather than in the network stack or content isolation mechanisms.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later, as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome on Android typically auto-updates via the Google Play Store, but administrators managing enterprise Android fleets should verify deployment via MDM policy. No formal workaround is documented by the vendor. While awaiting patch rollout, organizations may advise users to verify destination URLs through alternative means before entering credentials - for example, using bookmarks for sensitive sites rather than following links - though this is a behavioral control with no enforcement mechanism and should not substitute for patching.