What is the CVSS score of CVE-2026-17984?

CVE-2026-17984 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-17984?

Yes, a patch is available for CVE-2026-17984. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17984

EUVD-2026-50910 LOW

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-qxxx-vv5q-v4vq

Information Disclosure Google

3.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

Local vector because attacker must deliver a crafted HTML page to device; no integrity or availability impact, only limited cross-origin data leakage.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

LOW 3.3

DescriptionCVE.org

Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.

Technical ContextAI

CWE-346 (Origin Validation Error) identifies failures in correctly validating or enforcing origin boundaries - in this case within Chrome's browser implementation specifically on Android. The Same-Origin Policy (SOP) is the foundational web security primitive preventing one origin from reading data belonging to another; an 'inappropriate implementation' in the browser engine means Chrome's Android-specific code path does not correctly apply this boundary under certain conditions, allowing a crafted HTML page to extract data it should never be able to access. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases on Android before 151.0.7922.72. This class of bug differs from a classic SOP bypass in that it results from an implementation quirk rather than an explicit logic error, which aligns with Chromium's 'Inappropriate implementation' severity label.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later, which is confirmed as the patched release per the vendor advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates on Android are distributed through the Google Play Store and typically apply automatically; users and administrators should verify that automatic updates are enabled and confirm the installed version is at or above 151.0.7922.72. If an immediate update is not feasible, the practical compensating control is to instruct Android users not to open HTML pages from untrusted local sources, as the attack requires user interaction with a crafted page. There are no known configuration-level workarounds that disable the vulnerable code path without removing browser functionality. Given the low CVSS score and SSVC exploitation status of none, patch deployment in the next standard patch cycle is appropriate rather than emergency rollout.