What is the CVSS score of CVE-2026-17680?

CVE-2026-17680 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17680?

Chrome on ChromeOS versions prior to 151.0.7922.72 contain a heap buffer overflow that enables sandbox escape; organizations running ChromeOS devices face potential operating system compromise if…. A patch is available.

How to fix or mitigate CVE-2026-17680?

Within 24 hours, audit your ChromeOS fleet to identify current Chrome versions and prioritize devices with auto-update disabled. Within 7 days, deploy Chrome 151.0.7922.72 or later to all ChromeOS devices via your mobile device management system or ensure auto-update is enabled. Within 30 days, verify successful rollout across at least 95% of devices and review renderer process crash logs for indicators of exploitation attempts.

Google Chrome CVE-2026-17680

EUVD-2026-50806 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-30 Chrome

GHSA-cwp6-3cc4-8qxc

Buffer Overflow Google Heap Overflow

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Retained AV:N/PR:N/UI:R per Chromium convention treating renderer compromise as baseline; S:C reflects sandbox escape into the OS with full C/I/A impact, matching 9.6.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:30 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow located in Chromium's 'Color' handling code, which processes color values and profiles derived from web content (e.g., CSS colors, ICC/color-management data). Malformed input can cause an out-of-bounds write on the heap, corrupting adjacent allocator metadata or object pointers. Because the affected code runs in a privileged context reachable from the compromised renderer, a successful overflow can be leveraged to escape the renderer sandbox. The CPE cpe:2.3:a:google:chrome identifies the affected application as Google Chrome, and the description scopes real-world impact to the ChromeOS platform build. This is characteristic of a chained exploit: the memory-safety defect in Color is the sandbox-escape primitive, not the initial code-execution vector.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome/ChromeOS to 151.0.7922.72 or later, as published in the Chrome Stable Channel update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). On ChromeOS, ensure automatic OS updates are enabled and force a device restart to apply the pending update, and use enterprise policies (Google Admin console) to pin managed fleets to the fixed milestone. If immediate patching is not possible, reduce exposure to the initial renderer-compromise stage by restricting browsing to trusted sites and enforcing a strict site-isolation/enterprise browsing policy; note this only lowers the odds of the precursor renderer exploit and does not remove the Color overflow itself, so it is a stopgap, not a fix. There is no feature toggle that disables the vulnerable Color path without breaking rendering, so upgrading is the only reliable remediation.