What is the CVSS score of CVE-2026-17669?

CVE-2026-17669 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Chrome for iOS are affected by CVE-2026-17669?

Google Chrome for iOS versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability enabling remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-17669?

Within 24 hours, issue mandatory notification to all mobile users to immediately update Google Chrome for iOS to version 151.0.7922.72 or later via the App Store and verify Chrome version reporting is enabled in your MDM/EMM console. Within 7 days, complete device inventory to confirm all Chrome for iOS installations have reached 151.0.7922.72 or later, with priority given to enterprise devices and shared devices serving multiple users. Within 30 days, establish automated Chrome update policies within your MDM platform for iOS and formalize an expedited patch distribution process to reduce deployment latency for future critical iOS security releases.

Chrome for iOS CVE-2026-17669

EUVD-2026-50795 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-c8v5-9fjp-jxcc

Information Disclosure Google Apple

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges but requires the victim to open it (UI:R); sandbox escape crosses trust boundaries (S:C) with total impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:58 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.

Technical ContextAI

The flaw is classified under CWE-693 (Protection Mechanism Failure), describing a case where an existing security control - here the browser sandbox that isolates untrusted web content from the host device and other origins - is implemented inappropriately and can be bypassed rather than a memory-corruption primitive per se. The affected component is the Chrome for iOS application (CPE cpe:2.3:a:google:chrome), which on iOS is constrained by Apple's mandatory WebKit engine, so the 'sandbox escape' concerns Chrome's own process/isolation model layered atop iOS. A crafted HTML page triggers the weak protection boundary, and the CVSS scope-change flag (S:C) reflects that the impact crosses from the sandboxed renderer context into a more privileged security domain.

RemediationAI

Vendor-released patch: update Chrome for iOS to 151.0.7922.72 or later, which is the primary and recommended fix; on iOS this is delivered through the Apple App Store, so ensure automatic app updates are enabled or push the update via MDM for managed fleets. Refer to Google's advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue at https://issues.chromium.org/issues/513142464. Until devices are updated, reduce exposure by advising users not to open untrusted links or attacker-supplied HTML pages and by restricting browsing to trusted sites, since exploitation depends on loading a crafted page (UI:R); organizations can layer web/URL filtering or a secure web gateway to block known-malicious pages, accepting the trade-off that such controls cannot catch all novel malicious HTML and may impact browsing convenience.