What is the CVSS score of CVE-2026-17996?

CVE-2026-17996 has a contested CVSS base score of 6.2 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17996?

Yes, a patch is available for CVE-2026-17996. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17996

EUVD-2026-50922 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-qhgp-4m99-fhv7

Authentication Bypass Google

Medium

Disputed · 6.2 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.2 MEDIUM

Local attack via malicious file with no privileges needed; integrity-only impact; no confidentiality or availability effect; no scope change.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.9 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:32 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

6.2 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 6.2

DescriptionCVE.org

Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome on macOS (versions prior to 151.0.7922.72) permits a local attacker to circumvent the browser's navigation controls by delivering a crafted malicious file. The CVSS vector (AV:L/I:H) confirms the impact is limited to integrity - an attacker who achieves local access can subvert Chrome's navigation security model without requiring elevated privileges or user interaction beyond obtaining local system access. With an EPSS score of 0.10% (1st percentile), no CISA KEV listing, and Chromium's own classification of Low severity, real-world exploitation risk is low despite the 6.2 CVSS base score.

Technical ContextAI

The flaw is rooted in CWE-284 (Improper Access Control), specifically an 'inappropriate implementation' in Chrome's browser navigation subsystem on macOS. Navigation restrictions in Chromium enforce the browser security model by controlling which origins and file paths can be navigated to under various conditions (e.g., file:// URL access, cross-origin transitions, renderer-initiated navigations). A gap in this implementation on the Mac platform allows those controls to be bypassed via a malicious file. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* encompasses all prior Chrome releases; the platform scope is limited to macOS per the description. The fixed version is 151.0.7922.72, confirmed via the Chrome stable channel release advisory.

RemediationAI

Upgrade Google Chrome on all macOS systems to version 151.0.7922.72 or later, released via the Chrome stable channel. The vendor advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html documents the fix. Chrome's auto-update mechanism will apply this patch for most users without manual intervention; IT administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or equivalent MDM policies. If immediate patching is not feasible in managed environments, restricting local file system access for the Chrome process via macOS system policies (e.g., Full Disk Access controls in Privacy & Security settings) reduces the ability of local attackers to place or interact with malicious files. This workaround does not remediate the underlying flaw and may impact legitimate Chrome functionality.