What is the CVSS score of CVE-2026-17671?

CVE-2026-17671 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17671?

A critical sandbox escape in Google Chrome's ANGLE graphics component (CVE-2026-17671, CVSS 9.6) allows attackers who have compromised a browser renderer process to gain complete system access by…. A patch is available.

How to fix or mitigate CVE-2026-17671?

Within 24 hours: verify which Chrome versions are currently deployed across your organization and communicate the availability of the critical security update to all users. Within 7 days: deploy Chrome 151.0.7922.72 or later enterprise-wide through your configured update channels, testing in a limited set of systems first to ensure no compatibility issues. Within 30 days: complete verification that all Chrome instances have been updated to the patched version, configure monitoring for any exploitation attempts targeting the graphics component, and formally document patch compliance in your vulnerability management system.

Google Chrome CVE-2026-17671

EUVD-2026-50797 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-m365-x9xq-2p8x

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-existing renderer compromise and chained conditions; UI:R for page load; S:C and C/I/A:H reflect a full sandbox escape into the GPU/browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:57 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though it requires a pre-existing renderer compromise as a chained prerequisite. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL API calls into the platform-native backend (Direct3D, Metal, Vulkan, or desktop GL). It runs partly in the GPU process, which sits at a higher privilege boundary than the sandboxed renderer. The root cause is classified as CWE-20 (Improper Input Validation): ANGLE insufficiently validates untrusted input passed from the renderer, which a compromised renderer can abuse to cross the process/sandbox boundary. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build).

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - update to this build or later on the Stable channel via the built-in updater (chrome://settings/help) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through Google Update / enterprise policy and force a browser restart, since ANGLE code is only reloaded on relaunch. Users of other Chromium-based browsers should apply their vendor's corresponding update once it incorporates the ANGLE fix. If immediate patching is not possible, compensating controls include disabling hardware acceleration / WebGL (chrome://settings, 'Use graphics acceleration when available', or the WebGL enterprise policy) to reduce ANGLE attack surface - trade-off is degraded rendering/performance for graphics-heavy sites - and restricting untrusted browsing via site isolation and application allow-listing to lower the chance of the prerequisite renderer compromise.