What is the CVSS score of CVE-2026-17665?

CVE-2026-17665 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17665?

Google Chrome users across the organization running versions prior to 151.0.7922.72 face remote code execution risk when visiting malicious websites, exposing endpoints to potential compromise and…. A patch is available.

How to fix or mitigate CVE-2026-17665?

Within 24 hours: Deploy Chrome version 151.0.7922.72 or later to all managed endpoints and alert users to update immediately through browser notifications. Within 7 days: Verify patch deployment coverage through asset inventory scans and monitor security logs for exploitation attempts. Within 30 days: Complete a final audit confirming all organizational Chrome instances meet the minimum patched version and document remediation completion.

Google Chrome CVE-2026-17665

EUVD-2026-50791 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-fxx8-mrm7-3fhg

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); V8 UAF yields full renderer compromise (C/I/A:H) confined to the sandbox, so scope is unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:00 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.

Technical ContextAI

The vulnerability lives in V8, the C++ JavaScript/WebAssembly engine Chrome uses to JIT-compile and execute untrusted script from any web page. A use-after-free (CWE-416) occurs when the engine keeps referencing a heap object after it has been freed, letting an attacker who controls JavaScript reclaim that memory with attacker-controlled data and corrupt engine state - in V8 a well-known path to an arbitrary read/write primitive and ultimately code execution in the renderer. The affected component is identified by CPE cpe:2.3:a:google:chrome (all builds below the fixed version), and the corruption is reachable purely through content rendered on a malicious or compromised page.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Help > About Google Chrome) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy/MDM and force a browser restart, since the fix is inert until relaunch. If immediate patching is not possible, reduce exposure with URL/category filtering at the proxy to limit arbitrary web content and enable Chrome's Enhanced Safe Browsing; keep Site Isolation and the renderer sandbox enabled since this bug executes only inside the sandbox. These web-filtering controls only narrow the delivery surface and do not remove the flaw, so treat them as stopgaps until 151.0.7922.72 is deployed.