What is the CVSS score of CVE-2026-17678?

CVE-2026-17678 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17678?

Google Chrome versions prior to 151.0.7922.72 contain a graphics layer flaw that allows attackers who have already compromised a user's browser to escape the browser sandbox and execute system-level…. A patch is available.

How to fix or mitigate CVE-2026-17678?

Within 24 hours, notify administrators and security teams of Chrome's sandbox escape vulnerability; immediately scan enterprise endpoints to identify installations of Chrome versions prior to 151.0.7922.72 and assess exposure across user populations. Within 7 days, complete testing of Chrome 151.0.7922.72 in a staging environment, prepare deployment packages or managed update configurations, and establish a rollout timeline that prioritizes vulnerable systems. Within 30 days, deploy Chrome 151.0.7922.72 or later to all endpoints using automated update mechanisms or manual installation where necessary; confirm remediation through endpoint scanning or browser telemetry to ensure no unpatched instances remain.

Google Chrome CVE-2026-17678

EUVD-2026-50804 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-h6gj-q2pj-9v5j

Buffer Overflow Information Disclosure Google

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires prior renderer compromise (PR:L) and complex chaining (AC:H); successful sandbox escape crosses a trust boundary (S:C) with high C/I/A impact on the host.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:55 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that maps WebGL/OpenGL ES calls onto the host platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). It runs in the GPU process and processes attacker-influenceable graphics commands, making it a recurring sandbox-escape surface. The root cause is CWE-125 (Out-of-bounds Read): ANGLE reads memory outside the bounds of an allocated buffer, likely due to insufficient validation of shader or draw-call parameters passed from the renderer. Such a read can leak adjacent GPU-process memory (pointers, heap layout) that undermines ASLR and, combined with other primitives, aids escaping the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installs auto-update, so verify via chrome://settings/help and relaunch to apply. Users of Chromium-based browsers should install their vendor's build incorporating the equivalent Chromium version once available. As an interim compensating control before patching, restrict WebGL/GPU attack surface - for example disable hardware acceleration (chrome://settings, 'Use graphics acceleration when available') or disable WebGL, which reduces the ANGLE surface but degrades graphics-heavy site performance and 3D/canvas functionality. Enterprises can enforce update rollout via Chrome Browser Cloud Management / group policy to guarantee the fixed version is deployed.