What is the CVSS score of CVE-2026-17655?

CVE-2026-17655 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17655?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that allows remote attackers to break out of the renderer process via a…. A patch is available.

How to fix or mitigate CVE-2026-17655?

Within 24 hours, issue an urgent communication to all Chrome users notifying them of the critical vulnerability and availability of the vendor patch. Within 7 days, deploy Google Chrome 151.0.7922.72 or later across all systems through your standard patch management process, prioritizing business-critical systems and user-facing endpoints. Within 30 days, conduct a compliance audit to verify 100% patch deployment and document results for audit purposes.

Google Chrome CVE-2026-17655

EUVD-2026-50781 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-p3qq-x22v-cv22

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered crafted page needs no auth (PR:N) but requires the victim to visit it (UI:R); ANGLE lives in the sandboxed GPU process so a successful escape is scope-changing (S:C) with full host impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:32 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer, fixed in stable release 151.0.7922.72, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader access on the host. Rated Critical by Chromium and scored CVSS 9.6, the flaw stems from insufficient validation of untrusted input (CWE-20) processed by ANGLE and carries a scope-changing impact. There is no public exploit identified at time of analysis and EPSS is low at 0.31% (23rd percentile), but the Critical rating and sandbox-escape primitive make prompt patching important.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL / WebGPU calls from web content into the platform's native graphics API (Direct3D, Vulkan, or Metal). Because ANGLE runs inside Chrome's GPU process and parses complex, attacker-influenceable graphics command streams, a validation gap there is a high-value target. The root cause is classified as CWE-20 (Improper Input Validation): untrusted input from a web page is not sufficiently checked before ANGLE acts on it, and the resulting memory-safety or state-confusion condition can be leveraged to cross the renderer/GPU sandbox boundary. The affected component is identified in CPE as cpe:2.3:a:google:chrome, all versions prior to the fixed build 151.0.7922.72.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply, and confirm managed/enterprise fleets are not pinned to an older channel. Users of other Chromium-based browsers should apply the vendor build that incorporates the equivalent Chromium fix once available. No standalone workaround is provided by the vendor, but as an interim compensating control you can reduce GPU-process attack surface by disabling hardware acceleration (chrome://settings, 'Use graphics acceleration when available' off) or launching with --disable-gpu, which forces software rendering and largely removes the ANGLE code path - the trade-off is degraded WebGL/WebGPU performance, higher CPU use, and possible rendering glitches, so this is only a stopgap until the update is deployed. Reference the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.