What is the CVSS score of CVE-2026-17982?

CVE-2026-17982 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17982?

Yes, a patch is available for CVE-2026-17982. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17982

EUVD-2026-50908 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-9xf4-fpqh-x43r

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered SOP bypass requires victim to visit a crafted page (UI:R, AV:N, AC:L); no authentication needed; impact limited to integrity only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Same-origin policy bypass in Google Chrome's Cast component allows remote attackers to perform limited cross-origin integrity actions against victims who visit a crafted HTML page. All Chrome versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and Chromium's own internal severity rating is Low - signals that align with the very low EPSS score of 0.18% at the 8th percentile.

Technical ContextAI

The vulnerability resides in Chrome's Cast subsystem - the browser component responsible for streaming content to Chromecast and compatible display devices. The root cause is CWE-20 (Improper Input Validation): attacker-controlled input from a crafted HTML page is not adequately sanitized before being processed by the Cast component, allowing it to subvert the Same-Origin Policy (SOP). SOP is a foundational browser security boundary that prevents scripts loaded from one origin from reading or modifying resources belonging to a different origin. Bypassing it - even with limited scope - can enable unauthorized cross-origin writes or resource manipulation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases across platforms prior to 151.0.7922.72, as confirmed by EUVD-2026-50908.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this patch automatically to most consumer installations; enterprise administrators should push this update via Google Admin Console or their preferred endpoint management tooling. As a compensating control prior to patching, enterprises can disable the Cast feature entirely using the Chrome enterprise policy CastEnabled=false - note this removes all Cast/Chromecast streaming functionality as a trade-off. Given Chromium's own Low severity classification, EPSS at the 8th percentile, and absence of known exploits, this fix fits within a routine monthly patch cycle for most organizations.