What is the CVSS score of CVE-2026-17968?

CVE-2026-17968 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17968?

Yes, a patch is available for CVE-2026-17968. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17968

EUVD-2026-50894 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-3pmr-p7wr-4xgq

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N), requires victim to visit page (UI:R), no privileges needed (PR:N), confidentiality-only impact from uninitialized memory read.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:35 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.

Technical ContextAI

WebXR is a browser API that enables virtual and augmented reality experiences directly within web content, with complex rendering and memory management pipelines that interface with device sensors and GPU subsystems. The root cause is CWE-457 (Use of Uninitialized Variable): memory is read before being explicitly initialized, potentially exposing adjacent or previously allocated memory contents to the calling context - in this case, the web page's JavaScript environment. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Google Chrome as an application, though the vulnerability is constrained to the Android platform, indicating a platform-specific code path within the WebXR subsystem rather than a cross-platform flaw. The Chromium project internally classified this as Low severity, suggesting limited practical leakage in most configurations.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later, available through the Google Play Store automatic update mechanism or by manually checking for updates within the Chrome app settings. The fix is documented in the Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not feasible in managed environments, a compensating control is to restrict or disable WebXR via Chrome enterprise policy (DisableWebXR managed policy or chrome://flags/#webxr) - note that this will break legitimate WebXR, AR, and VR web experiences and may affect productivity applications relying on those features. Enforcing Chrome Auto-Update via Google Workspace or MDM policies ensures timely application of this and future fixes with minimal operational disruption.