What is the CVSS score of CVE-2026-17650?

CVE-2026-17650 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17650?

Google Chrome versions prior to 151.0.7922.72 contain a sandbox escape vulnerability that allows attackers to break out of the browser and gain system-level code execution.. A patch is available.

How to fix or mitigate CVE-2026-17650?

Immediately initiate an audit of all Chrome installations to identify versions prior to 151.0.7922.72 within the next 24 hours. Within 7 days, begin staged deployment of Chrome 151.0.7922.72 or later, prioritizing high-risk systems including those handling financial data, personnel records, or with internet-facing access. Complete organization-wide deployment of the patched version within 30 days, with mandatory updates enforced on all corporate-managed endpoints.

Google Chrome CVE-2026-17650

EUVD-2026-50776 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-hcvj-frqw-68mv

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page with UI:R and high-complexity heap exploitation; the required prior renderer compromise is modeled as an attack condition (AC:H) rather than PR, and the sandbox escape yields S:C with total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.9 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:32 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

8.3 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Compositing subsystem, the part of Blink/the browser process responsible for turning rendered layers into the final on-screen image (the compositor manages layer trees, GPU surfaces, and frame lifecycle). A use-after-free arises when compositor code retains and dereferences a pointer to an object whose backing memory has already been freed, allowing an attacker who controls heap layout to reclaim that memory and steer execution. Because Chrome isolates web content in a low-privilege renderer sandbox, a bug reachable across the renderer/browser boundary (as here) enables a sandbox escape into the more privileged browser process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; the same fix ships to all Chromium-based browsers that pull the upstream release.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms (Chrome's built-in updater delivers this automatically; force it via chrome://settings/help and relaunch to apply). Enterprises should confirm managed update policies are not pinning Chrome to an older milestone and expedite ring rollout given the Critical severity. Users of Chromium-based browsers should apply their vendor's build that incorporates the equivalent fix. There is no configuration-only workaround for the compositor code itself; as a compensating control, enabling site isolation (default) and avoiding disabling the sandbox (never run with --no-sandbox) preserves the very boundary this bug attacks, and restricting users to trusted sites reduces exposure to the crafted-page delivery - though neither substitutes for patching. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and https://issues.chromium.org/issues/514442821.