What is the CVSS score of CVE-2026-17673?

CVE-2026-17673 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17673?

Google Chrome sandbox escape vulnerability (CVE-2026-17673, CVSS 9.6) enables post-compromise attackers to escape the browser sandbox and access the host system, a critical capability that could lead…. A patch is available.

How to fix or mitigate CVE-2026-17673?

Within 24 hours: Deploy notifications to all users explaining the critical patch requirement and block unpatched Chrome versions from accessing enterprise systems if technically feasible. Within 7 days: Achieve 95%+ deployment of Chrome 151.0.7922.72 or later across all user endpoints through automated patching or mandatory updates; verify deployment through endpoint management tools. Within 30 days: Conduct audit of Chrome deployments to confirm 100% patching completion and implement automated monthly Chrome update policies to prevent future critical gaps.

Google Chrome CVE-2026-17673

EUVD-2026-50799 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-30 Chrome

GHSA-vfc9-3hpj-ph62

Buffer Overflow Google Integer Overflow

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a prior renderer compromise (modeled as PR:L) and chaining plus user interaction raise complexity to AC:H; sandbox escape justifies S:C with high C/I/A.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:56 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.

Technical ContextAI

QUIC is Google's UDP-based transport protocol (the basis of HTTP/3) implemented natively in Chrome's network service. The root cause is CWE-190 (Integer Overflow or Wraparound), where arithmetic on attacker-influenced values wraps past the maximum representable integer, typically leading to undersized buffer allocations and subsequent out-of-bounds memory access - consistent with the 'Buffer Overflow' tag applied to this issue. Because QUIC parsing and the memory-corruption primitive are reachable in a way that lets a compromised renderer influence a more privileged process, this becomes a sandbox-escape vector rather than a simple renderer crash. The affected component is the desktop Chrome browser (CPE cpe:2.3:a:google:chrome), fixed in the Stable channel build 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, as announced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to ensure the update is applied since Chrome staged updates only take effect after a relaunch. In managed environments, push the update via enterprise policy or your endpoint management tooling and verify the reported version on endpoints. As an interim compensating control before patching, you can disable QUIC/HTTP/3 via the enterprise policy or the chrome://flags 'Experimental QUIC protocol' setting to remove the vulnerable transport path - the trade-off is that connections fall back to TCP/HTTP2, which may slightly increase latency but generally maintains functionality. Because exploitation requires a prior renderer compromise, keeping the browser fully updated (site isolation and renderer sandbox intact) is the most effective control.