What is the CVSS score of CVE-2026-17652?

CVE-2026-17652 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17652?

Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-17652, CVSS 9.6) affecting versions prior to 151.0.7922.72.. A patch is available.

How to fix or mitigate CVE-2026-17652?

Within 24 hours, inventory Chrome deployments and their current versions to identify affected systems. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all endpoints through your browser management or standard patching processes. Within 30 days, verify patch deployment completion across all organizational assets and review browser security policies to minimize attack surface from renderer-level compromises.

Google Chrome CVE-2026-17652

EUVD-2026-50778 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-wqjr-h479-pxvp

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N with UI:R since a crafted page is loaded, but AC:H because escape requires a pre-existing renderer compromise; scope changes from renderer sandbox to browser process with high impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:23 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Views, Chromium's cross-platform UI toolkit used to build browser windows, menus, and controls in the privileged browser process. A use-after-free occurs when memory is freed but a dangling pointer to it is later dereferenced; an attacker who controls heap allocations can reclaim the freed region and steer execution or corrupt state. Because Views runs in the higher-privilege browser process (outside the renderer sandbox), a memory-corruption primitive here is a classic sandbox-escape vector. The single CPE (cpe:2.3:a:google:chrome:*) confirms the affected component is the Chrome desktop application itself; the crafted HTML page is the delivery mechanism that drives the renderer to trigger the browser-side free/use sequence.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, then fully relaunch the browser so the new binary loads (per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, push the update via your existing browser-management policy and confirm rollout, since Chrome's auto-update can be delayed by pinned versions or offline endpoints. No standalone workaround neutralizes a browser-process UAF, but because exploitation requires a prior renderer compromise, keeping site isolation enabled (default), avoiding untrusted or unnecessary browser extensions, and ensuring the whole Chromium fleet - including embedded/Electron and other Chromium-based browsers - is patched reduces the chance an attacker obtains the renderer foothold this bug depends on; the trade-off of these controls is operational only (extension review overhead), not functional loss of the browser.