What is the CVSS score of CVE-2026-17660?

CVE-2026-17660 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17660?

Google Chrome versions before 151.0.7922.72 contain a privilege escalation vulnerability that allows an attacker who has compromised the browser process to access the underlying operating system and…. A patch is available.

How to fix or mitigate CVE-2026-17660?

Within 24 hours, identify and catalog all Chrome installations across corporate infrastructure, noting versions currently deployed and prioritizing systems exposed to untrusted web content. Within 7 days, deploy Chrome version 151.0.7922.72 or later organization-wide through your patch management system, enabling automatic updates and testing the rollout on a representative subset of systems before full deployment. Within 30 days, verify patching completion across all endpoints via endpoint management reporting, review Chrome security policies for alignment with organizational risk profile, and document the patch deployment for compliance records.

Google Chrome CVE-2026-17660

EUVD-2026-50786 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-36fh-9j3c-fp3f

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Attacker must first control the renderer, so PR:H; AC:H and UI:R reflect chaining plus a crafted page; scope changes on sandbox escape with full host impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Network component before 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage bug that must be chained with an initial renderer exploit rather than exploited in isolation. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile).

Technical ContextAI

The flaw lives in Chrome's Network service, a component of the Chromium multi-process architecture that brokers network requests on behalf of the sandboxed renderer. The root cause is classified as CWE-20 (Improper Input Validation): the Network component insufficiently validates untrusted input coming from a renderer that an attacker already controls, letting that input cross the renderer/broker trust boundary. Because Chrome deliberately treats the renderer as untrusted, any logic that accepts renderer-supplied data without strict validation can become a sandbox-escape primitive, which is why the CVSS scope is marked Changed (S:C). The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on every desktop platform, then fully restart the browser so all renderer and network processes reload the patched code - Chrome auto-updates but the fix does not take effect until relaunch. Verify via chrome://settings/help and enforce the minimum version through enterprise policy or your patch-management tooling for managed fleets. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and issue tracker https://issues.chromium.org/issues/497428001. There is no configuration toggle that specifically neutralizes this Network-component bug; as compensating controls until patched, restrict browsing of untrusted sites, deploy site isolation and OS-level sandboxing (already default), and use application allowlisting/EDR to catch post-escape activity - these reduce but do not eliminate exposure, at the cost of some usability and coverage gaps.