What is the CVSS score of CVE-2026-17975?

CVE-2026-17975 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17975?

Yes, a patch is available for CVE-2026-17975. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17975

EUVD-2026-50901 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-hgrf-m284-h2cv

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via HTML page (AV:N), no privileges needed (PR:N), user must visit page (UI:R); process memory exposure justifies C:H as worst-case; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:32 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.

Technical ContextAI

The Input Method Editor (IME) is an OS-level subsystem that intercepts keystrokes to compose complex characters, widely used for East Asian language input (CJK). On macOS, Chrome integrates with the native IME framework through inter-process and browser-renderer communication layers. The vulnerability stems from an 'inappropriate implementation' in this integration - likely involving improper bounds checking, buffer management, or state machine handling in the IME input pipeline - that allows a crafted HTML page to trigger disclosure of adjacent or uninitialized memory from the Chrome renderer process. No CWE is assigned, but the memory disclosure pattern is consistent with CWE-200 (Exposure of Sensitive Information) or CWE-125 (Out-of-bounds Read). The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to the macOS platform per the description and tags; Chrome on Windows and Linux is not cited as affected.

RemediationAI

Update Google Chrome on macOS to version 151.0.7922.72 or later, which resolves this vulnerability per the official Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, but administrators should verify managed deployments have applied the update via fleet management tooling. As a compensating control in environments where immediate patching is not possible, URL filtering to block access to untrusted or external web content reduces the attack surface, though at significant usability cost. Alternatively, restricting browser use to an allowlisted set of trusted domains via enterprise policy (e.g., URLBlocklist/URLAllowlist in Chrome's managed policies) limits exposure without fully blocking browsing. Disabling IME input methods is theoretically a narrowing control but is operationally disruptive for users requiring CJK input and is not recommended as a practical mitigation.