What is the CVSS score of CVE-2026-17651?

CVE-2026-17651 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17651?

Google Chrome for Android versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could fully compromise mobile devices; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-17651?

Within 24 hours, inventory all Chrome for Android devices in your organization and notify users of the critical security update requirement. Within 7 days, push Chrome for Android version 151.0.7922.72 or later through your mobile device management platform and verify deployment across all endpoints. Within 30 days, audit compliance and enforce update completion for any non-compliant devices, particularly those accessing email or corporate data.

Google Chrome CVE-2026-17651

EUVD-2026-50777 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-26pv-hgm3-4wj5

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote, unauthenticated page-load reaches Dawn (AV:N/PR:N/UI:R); sandbox escapes typically need chaining and specific state, so AC:H; escape crosses the sandbox boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:30 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from insufficient input validation in Dawn, Chromium's WebGPU implementation, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer/GPU-process sandbox (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; EPSS is low at 0.31% (23rd percentile), consistent with SSVC rating exploitation as 'none' despite a 'total' technical impact. Chrome rates the underlying Chromium bug as Critical.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing web pages low-level access to GPU compute and rendering through the browser's GPU process. Because WebGPU exposes a large, complex attack surface that parses and acts on richly structured, attacker-controllable command data, a CWE-20 (Improper Input Validation) defect here means untrusted input from a web page is not adequately checked before use, which can corrupt GPU-process state. The scope-changed CVSS metric (S:C) and 'sandbox escape' framing indicate the impact crosses the renderer/GPU sandbox boundary into a more privileged context. The single affected CPE is cpe:2.3:a:google:chrome, with the described impact specific to the Android build prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later via the Google Play Store, which is the primary and recommended fix; this should apply automatically for most managed and consumer devices but should be verified in enterprise fleets. Reference the Chrome release note at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-17651. If patching cannot be completed immediately, a targeted compensating control is to disable WebGPU (the Dawn attack surface) via the chrome://flags 'Unsafe WebGPU' / WebGPU flags or enterprise policy where available - trade-off: this breaks GPU-accelerated web apps and games that rely on WebGPU. As a broader stopgap, restrict browsing on unpatched Android devices to trusted sites, since exploitation requires the victim to load a crafted page.