What is the CVSS score of CVE-2026-17966?

CVE-2026-17966 has a contested CVSS base score of 6.2 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17966?

Yes, a patch is available for CVE-2026-17966. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17966

EUVD-2026-50892 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-r448-82mr-7599

Information Disclosure Google

Medium

Disputed · 6.2 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

AV:L confirmed by description; UI:R corrected from provided UI:N because a crafted HTML page requires user rendering action; no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:32 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.2

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.

Technical ContextAI

Chrome's Views framework is the cross-platform UI toolkit responsible for rendering browser chrome elements (toolbars, dialogs, widgets) on top of the OS windowing system. On macOS, the Views layer interfaces with Cocoa/AppKit, and implementation divergences between platforms can introduce subtle memory handling errors. An 'inappropriate implementation' (CWE not assigned) in this context typically means a logic or state-management flaw - rather than a classic memory corruption - that causes the component to read or expose adjacent process memory contents when processing specific DOM or layout inputs from an HTML page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to macOS builds prior to 151.0.7922.72. No specific CWE has been assigned by NVD, leaving the precise root cause class unconfirmed.

RemediationAI

The primary fix is updating Google Chrome on macOS to version 151.0.7922.72 or later, available via Chrome's built-in auto-update mechanism or manual download from google.com/chrome. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html confirms patch availability. For environments where immediate patching is not possible, restricting user access to untrusted local HTML files and enforcing Chrome's site isolation features (--site-per-process, which is default on modern Chrome) may reduce the memory surface exposed to a crafted page. Given the local attack vector, ensuring strong endpoint access controls and preventing untrusted local file execution are effective compensating controls. No workarounds short of upgrading are confirmed by the vendor.