What is the CVSS score of CVE-2026-17657?

CVE-2026-17657 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17657?

Google Chrome users running versions prior to 151.0.7922.72 face a high-severity sandbox escape vulnerability (CVSS 8.3) capable of enabling system-level code execution if exploited as part of a…. A patch is available.

How to fix or mitigate CVE-2026-17657?

Within 24 hours: Identify Chrome deployment scope and affected user count by inventorying systems running versions prior to 151.0.7922.72. Within 7 days: Deploy Google Chrome version 151.0.7922.72 or later organization-wide using native auto-update mechanisms or MDM/endpoint management solutions. Within 30 days: Validate complete patch deployment through endpoint telemetry and establish monitoring for suspicious process execution or privilege escalation that might indicate exploitation attempts.

Google Chrome CVE-2026-17657

EUVD-2026-50783 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-9w9w-6mf2-jrc7

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Attacker must already control the renderer (PR:L) and groom the heap (AC:H) while the victim loads malicious content (UI:R); sandbox escape crosses a trust boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromium's Navigation subsystem, the machinery that handles page loads, session history, frame lifecycle, and document commits across the browser and renderer processes. Use-after-free bugs occur when a pointer to a freed object is subsequently dereferenced, allowing an attacker who controls heap allocation to place attacker-chosen data where the freed object used to be and thereby corrupt control flow or object state. Because Navigation logic straddles the privileged browser process and the sandboxed renderer, a UAF here is especially valuable for crossing the sandbox boundary. The affected product per CPE is cpe:2.3:a:google:chrome:*, i.e. the Google Chrome desktop browser built on Chromium.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72 (or later) on the Stable channel - update Chrome and relaunch so the new version takes effect, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update via your enterprise policy/MDM and verify version compliance rather than relying on user-initiated updates. Users of other Chromium-based browsers should install the vendor build that incorporates the equivalent Chromium fix. No standalone configuration workaround exists for a memory-corruption bug in Navigation; as interim compensating controls, ensure the built-in sandbox is not disabled (never run with --no-sandbox), enable site isolation, and reduce exposure to untrusted pages, accepting that these reduce but do not eliminate risk until the update is applied.