What is the CVSS score of CVE-2026-17661?

CVE-2026-17661 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17661?

Google Chrome's Loader component contains a remote code execution vulnerability (CVE-2026-17661) affecting versions before 151.0.7922.72 that could allow attackers to execute code when users visit a…. A patch is available.

How to fix or mitigate CVE-2026-17661?

Within 24 hours, inventory all Chrome deployments across the organization and confirm current version status; flag any devices running versions before 151.0.7922.72 for priority patching. Within 7 days, deploy Chrome 151.0.7922.72 or later to all endpoints using automated patch management tools, prioritizing systems handling sensitive data or running administrative accounts. Within 30 days, complete universal patch deployment verification, document patch application across all Chrome installations, and configure endpoint monitoring for anomalous renderer process crashes or unexpected behavior that could signal exploitation attempts.

Google Chrome CVE-2026-17661

EUVD-2026-50787 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-cjp4-vqvh-cq9p

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); code runs within the renderer sandbox so scope stays Unchanged with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).

Technical ContextAI

The defect is a use-after-free (CWE-416) in Chromium's Loader subsystem, the component responsible for fetching and processing resources (documents, subresources) that feed the rendering pipeline. Use-after-free bugs arise when a pointer to freed heap memory is reused, letting an attacker groom the heap so the dangling reference points to attacker-controlled data, corrupting object state to redirect execution. Affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build). Because the code runs in the multi-process renderer, exploitation lands inside the sandboxed renderer process rather than the privileged browser process.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 151.0.7922.72 or later on the Stable channel; Chrome typically auto-updates, so confirm via chrome://settings/help and relaunch to apply, and use enterprise policies (e.g., forced auto-update, minimum-version enforcement) to guarantee fleet-wide rollout. Reference Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-17661. Users of Chromium-based browsers should update to the build that incorporates the corresponding fix. There is no configuration toggle that disables the vulnerable Loader path, so patching is the only reliable fix; as an interim compensating control, restrict browsing to trusted sites and deploy web/URL filtering to reduce exposure to attacker-controlled pages, accepting the usability trade-off that broad filtering can block legitimate content.