What is the CVSS score of CVE-2026-17665?

CVE-2026-17665 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17665?

Google Chrome users across the organization running versions prior to 151.0.7922.72 face remote code execution risk when visiting malicious websites, exposing endpoints to potential compromise and…. A patch is available.

How to fix or mitigate CVE-2026-17665?

Within 24 hours: Deploy Chrome version 151.0.7922.72 or later to all managed endpoints and alert users to update immediately through browser notifications. Within 7 days: Verify patch deployment coverage through asset inventory scans and monitor security logs for exploitation attempts. Within 30 days: Complete a final audit confirming all organizational Chrome instances meet the minimum patched version and document remediation completion.

Google Chrome CVE-2026-17665

EUVD-2026-50791 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-fxx8-mrm7-3fhg

Google Use After Free RCE Denial Of Service Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page with no auth (AV:N/PR:N) but needs the victim to open it (UI:R); V8 UAF yields full renderer compromise (C/I/A:H) confined to the sandbox, so scope is unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:00 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Malicious JavaScript triggers V8 use-after-free

Exploit

Reclaim freed object for read/write primitive

Execution

Execute arbitrary code in renderer sandbox

Impact

Requires separate escape for host compromise

Access

Lure victim to crafted HTML page

Delivery

Malicious JavaScript triggers V8 use-after-free

Exploit

Reclaim freed object for read/write primitive

Execution

Execute arbitrary code in renderer sandbox

Impact

Requires separate escape for host compromise

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open attacker-controlled web content in a vulnerable Chrome build below 151.0.7922.72 - the CVSS UI:R and the description's 'crafted HTML page' confirm required user interaction (visiting/rendering the page), which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed and must be weighed together rather than on CVSS alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious HTML page (or injects script into a compromised or ad-served page) that drives V8 into the use-after-free, then sprays the freed slot to gain a read/write primitive and execute code within the renderer sandbox. A victim running a vulnerable Chrome build only needs to visit the page - no clicks or credentials beyond the visit. …
Remediation	Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Help > About Google Chrome) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Deploy Chrome version 151.0.7922.72 or later to all managed endpoints and alert users to update immediately through browser notifications. …

Threat intelligence, references, and detailed analysis are available after sign-in.