What is the CVSS score of CVE-2026-17672?

CVE-2026-17672 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17672?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape in the Chromecast component (CVE-2026-17672, CVSS 9.6) that allows attackers who have compromised the renderer process…. A patch is available.

How to fix or mitigate CVE-2026-17672?

Within 24 hours, audit your inventory management systems and browser deployment tools to identify all Chrome instances running versions prior to 151.0.7922.72 across endpoints, servers, and managed devices. Within 7 days, deploy Chrome 151.0.7922.72 or later through your standard patch management process, prioritizing systems with administrative privileges or access to sensitive data. Within 30 days, perform compliance verification across 100% of Chrome installations to confirm minimum version 151.0.7922.72, and evaluate application whitelisting or browser sandboxing controls to reduce renderer exploitation surface.

Google Chrome CVE-2026-17672

EUVD-2026-50798 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-9rfm-7jrw-fvc4

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Kept AV:N/UI:R/S:C with full impact for the sandbox escape, but raised AC:L to AC:H because exploitation depends on first compromising the renderer, a non-trivial precondition.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:57 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 due to scope change, it is a classic second-stage browser exploit chained after an initial renderer bug. No public exploit is identified at time of analysis and EPSS is low (0.29%), consistent with a bug requiring a prior renderer foothold rather than a single-shot drive-by.

Technical ContextAI

The flaw lives in Chrome's Chromecast/media-casting subsystem, which handles device discovery and content streaming between the browser and Cast receivers. Chrome enforces a multi-process security model where untrusted web content runs inside a low-privilege sandboxed renderer, and privileged operations must cross an IPC boundary to the more-trusted browser process. Classified as CWE-20 (Improper Input Validation), the root cause is insufficient validation of untrusted input crossing this boundary, so a message or data structure originating from a compromised renderer is trusted more than it should be, permitting escalation out of the sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all pre-151.0.7922.72 desktop builds.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72. Update Chrome to 151.0.7922.72 or later on all desktop platforms via the browser's built-in updater (Settings then About Chrome, followed by a relaunch) or enterprise deployment tooling, and restart the browser to apply the update, per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires an already-compromised renderer, interim compensating controls target the initial foothold and the vulnerable feature: keep site-isolation defenses default-enabled, and where Cast functionality is not needed disable or restrict the Chromecast/media-router feature (enterprise policy EnableMediaRouter=false) to shrink the attack surface, accepting the trade-off that users lose in-browser casting. Downstream Chromium browsers should be updated once their vendors ship the merged fix.