What is the CVSS score of CVE-2026-17677?

CVE-2026-17677 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17677?

Google Chrome for Android versions prior to 151.0.7922.72 contain a high-severity sandbox escape vulnerability that allows remote code execution when users visit a malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-17677?

Within 24 hours, inventory all Chrome for Android installations across enterprise MDM platforms and personal devices to identify versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later as a mandatory update through your mobile device management system, prioritizing corporate-owned devices and BYOD endpoints with access to internal networks. Within 30 days, verify patch deployment completion through MDM compliance reports and audit that no unpatched instances remain.

Google Chrome CVE-2026-17677

EUVD-2026-50803 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-q8qc-mmgg-hvh6

Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page with no auth (PR:N) but mandatory user interaction (UI:R); sandbox escape yields high C/I/A, though S:U is retained per the provided vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:55 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox using a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, the flaw requires the victim to visit a malicious page (user interaction) but no authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a recently disclosed browser bug fixed before weaponization.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chromium uses to convert OpenGL ES / WebGL calls from web content into the native graphics API of the host platform (on Android, typically Vulkan or OpenGL ES via the GPU driver). Because WebGL exposes GPU functionality to untrusted JavaScript, ANGLE runs as a critical trust boundary between the sandboxed renderer and the more privileged GPU process. The CWE-693 (Protection Mechanism Failure) classification indicates the root cause is not a classic memory-corruption primitive but rather an incorrect or incomplete enforcement of an intended security control - here, the sandbox isolation itself - meaning crafted graphics operations bypass a barrier that was supposed to contain them. The affected CPE is cpe:2.3:a:google:chrome, though the description explicitly scopes the exploitable condition to the Android build.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later, which is the vendor-released patch per the Chrome Stable Channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this is delivered through the Google Play Store, so ensure automatic app updates are enabled and force an update on managed fleets via MDM. There is no supported configuration flag that disables ANGLE or WebGL cleanly on Android Chrome for end users, so patching is the definitive fix; as an interim compensating control for high-risk users you can restrict browsing to trusted sites and avoid untrusted links until the update propagates, accepting that this does not eliminate the risk and only reduces exposure to malicious pages. Organizations using enterprise policy can shorten the update window by mandating the minimum Chrome version through Chrome Browser Cloud Management or MDM compliance rules.