What is the CVSS score of CVE-2026-17656?

CVE-2026-17656 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17656?

Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could allow attackers to gain system-level access on affected employee workstations.. A patch is available.

How to fix or mitigate CVE-2026-17656?

Within 24 hours, identify all Chrome installations across your organization through your endpoint management tools and issue a mandatory security alert to all users advising against untrusted websites. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all systems via your patch management system, prioritizing business-critical workstations and those with access to sensitive data. Within 30 days, achieve 100% deployment of Chrome 151.0.7922.72 or later across the enterprise, validate patch compliance through automated reporting, and review security logs for any exploitation attempts targeting this CVE.

Google Chrome CVE-2026-17656

EUVD-2026-50782 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-6wpc-625g-qwg8

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered via a crafted page with no auth (PR:N) but requiring the victim to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

10.0 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:31 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.

Technical ContextAI

Ozone is Chromium's platform abstraction layer that mediates low-level windowing, graphics/GPU surface, and input handling across backends (X11, Wayland, DRM). The flaw is CWE-416 (Use After Free): a memory object in Ozone is freed while a dangling reference remains reachable, and subsequent access to that stale pointer allows an attacker to influence freed-then-reallocated memory. Because Ozone sits at the boundary between the sandboxed renderer and higher-privileged browser/GPU processes, corrupting its state is a classic primitive for a sandbox escape rather than a mere renderer crash. The affected surface per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build), i.e. the desktop Chrome browser across platforms using the Ozone stack.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade to this build or later on all desktop endpoints per the Stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply the update, and push the update through enterprise management (Google Update / policy) to ensure fleet coverage. There is no product-specific configuration workaround for a memory-corruption sandbox escape; as an interim compensating control before patch rollout completes, limit exposure by restricting browsing to trusted sites and enabling stricter site isolation, though this does not neutralize the underlying bug and only reduces the chance of encountering a malicious page. Users of Chromium-based browsers should apply their vendor's corresponding update once published.