What is the CVSS score of CVE-2026-17981?

CVE-2026-17981 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17981?

Yes, a patch is available for CVE-2026-17981. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17981

EUVD-2026-50907 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-mmfc-rp68-vjq2

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page (AV:N), no attacker privileges needed (PR:N), victim must visit page (UI:R), read-only limited data leak with no integrity or availability impact (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:39 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) exposes data protected by the Same-Origin Policy to remote attackers who can lure a victim to a crafted HTML page. The flaw, classified as CWE-346 (Origin Validation Error), allows Blink to improperly handle origin boundaries, enabling a malicious page to read cross-origin resource data. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with SSVC's 'Exploitation: none' designation and absence from CISA KEV.

Technical ContextAI

Blink is Google Chrome's HTML and DOM rendering engine, forked from WebKit and responsible for parsing, layout, and script execution. CWE-346 (Origin Validation Error) indicates that Blink fails to correctly enforce origin boundaries under a specific implementation path, permitting reads of data that the Same-Origin Policy is designed to isolate. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all platforms and all Chrome versions prior to the 151.0.7922.72 stable release. The specific Chromium issue is tracked at issues.chromium.org/issues/519719512, though that report is likely restricted pending broader patch adoption. The vulnerability is classified by the Chrome team as 'Low' severity in Chromium's internal scale, consistent with the limited (partial) confidentiality impact and mandatory user interaction.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will apply this update in most consumer environments; enterprise administrators should confirm deployment through fleet management tools or Google Admin Console policies. Where immediate patching is not feasible, server-side mitigations can reduce exposure: enforcing strict CORS headers and Cross-Origin Resource Policy (CORP: same-origin) on sensitive resources limits what a malicious page can request cross-origin, though these are server-side compensating controls and do not fix the browser-side flaw. Content Security Policy on sensitive web applications can further restrict which origins may embed or interact with protected resources, at the cost of some implementation complexity.