What is the CVSS score of CVE-2026-17970?

CVE-2026-17970 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17970?

Yes, a patch is available for CVE-2026-17970. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17970

EUVD-2026-50896 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-w33c-hx6r-vg4p

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

AC raised to H because description explicitly requires privileged network position (MITM), contradicting AC:L; all other metrics align with NVD vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:34 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.

Technical ContextAI

The vulnerability resides in Chrome's built-in Passwords subsystem and is rooted in CWE-20 (Improper Input Validation). Insufficient sanitization of server-supplied or intercepted network input allows a malicious network intermediary to craft responses that alter the rendering of password-related UI dialogs or prompts within the browser. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all desktop Chrome versions across platforms. Chromium's internal severity rating is Low, indicating the project's own assessment that the attack surface and practical impact are constrained. The flaw does not expose stored credential data directly but could be used to present deceptive UI to a victim user.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Menu → Help → About Google Chrome) or through enterprise software management tooling. The release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html documents this fix. For environments where immediate browser updates are not feasible, enforcing VPN or TLS-inspecting proxy usage on all managed endpoints reduces the viable attack surface by limiting untrusted network intermediaries; however, this does not eliminate the vulnerability and carries the trade-off of added network infrastructure complexity. No feature-level workaround within Chrome is documented.