What is the CVSS score of CVE-2026-17676?

CVE-2026-17676 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17676?

Google Chrome on Android contains a sandbox escape vulnerability in the ANGLE graphics layer (CVE-2026-17676, CVSS 9.6) that could allow an attacker who has already compromised the renderer process…. A patch is available.

How to fix or mitigate CVE-2026-17676?

Within 24 hours, inventory Chrome versions across Android devices in your organization using MDM or mobile security scanning to identify exposure to versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later to all Android devices via app distribution channels or MDM policy, prioritizing devices used by high-risk user groups. Within 30 days, verify complete deployment across all in-scope Android devices, establish continuous version monitoring to detect non-compliance or rollbacks, and close this finding in your vulnerability management system.

Google Chrome CVE-2026-17676

EUVD-2026-50802 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-w4xq-p7f5-g2wm

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Crafted page delivered over the network (AV:N) with victim page-load (UI:R); the sandbox escape yields a scope change (S:C) with full host impact; PR:N is retained per official scoring though a prior renderer compromise is required in practice.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:30 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. There is no public exploit identified at time of analysis, and EPSS is low (0.29%, 21st percentile), consistent with a bug that only becomes useful after a prior renderer compromise.

Technical ContextAI

The flaw lives in ANGLE (Almost Native Graphics Layer Engine), the abstraction library Chrome uses to translate WebGL/OpenGL ES calls onto the underlying platform graphics backend (on Android, typically OpenGL ES/Vulkan). ANGLE processes GPU-related work reachable from untrusted web content, making it a recurring target for renderer-to-host escapes. The root cause is classified as CWE-693 (Protection Mechanism Failure): an 'inappropriate implementation' in which a control meant to contain untrusted rendering work fails to fully enforce its boundary, letting a compromised renderer reach beyond the sandbox. The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome application, with the specific exposure being the Android build.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this ships through Google Play, so ensure automatic app updates are enabled and force updates on managed fleets via MDM. Because the bug requires a prior renderer compromise, keeping Chrome fully patched also raises the bar on the initial renderer RCE needed to reach it. Where WebGL/GPU acceleration is not required, disabling WebGL via enterprise policy or chrome://flags is a compensating control that shrinks the ANGLE attack surface, with the trade-off that it breaks WebGL-dependent sites and 3D content; no configuration workaround fully substitutes for the update, so patching is the primary action.