What is the CVSS score of CVE-2026-17681?

CVE-2026-17681 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17681?

Google Chrome for Android versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could allow attackers to fully compromise Android devices, though only after first…. A patch is available.

How to fix or mitigate CVE-2026-17681?

Within 24 hours: notify Android device users and IT teams to enable automatic Chrome updates in the Google Play Store and verify current Chrome version. Within 7 days: conduct inventory of Android devices in your organization and enforce minimum Chrome version 151.0.7922.72 through mobile device management (MDM) policies where available. Within 30 days: audit application security testing practices to identify and patch renderer-process vulnerabilities that could serve as the initial stage for this sandbox escape, and consider implementing application-level security monitoring for Chrome on Android.

Google Chrome CVE-2026-17681

EUVD-2026-50807 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5mm6-fj7r-pv27

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Delivered via a web page (AV:N, UI:R) with no target credentials (PR:N); sandbox breakout yields a scope change (S:C) and full browser-process compromise (C/I/A:H), though a prior renderer exploit is a practical prerequisite.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:31 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted untrusted input to the Web Authentication (WebAuthn) component. Rated High severity by Chromium and scored CVSS 9.6, it is a second-stage bug chained after an initial renderer exploit rather than a standalone remote compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.34% (27th percentile).

Technical ContextAI

The flaw lives in Chrome's Web Authentication (WebAuthn) implementation, the browser API that brokers FIDO2/passkey and hardware-security-key ceremonies between web pages and the platform. On Android, WebAuthn requests cross from the sandboxed renderer to higher-privilege browser-process code that handles credential and authenticator data. The root cause is CWE-20 (Improper Input Validation): the trusted browser-side code insufficiently validates data arriving from the untrusted renderer, so a renderer under attacker control can supply malformed input that the privileged process mishandles. The affected code path is identified by Chromium issue 516813184. The single CPE (cpe:2.3:a:google:chrome:*) is version-generic, but the description scopes impact specifically to the Android build prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome for Android to 151.0.7922.72 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this is delivered through the Google Play Store, so ensure automatic app updates are enabled and force-update managed fleets via MDM. There is no configuration workaround for the WebAuthn code path itself, but because exploitation requires a prior renderer compromise, the practical compensating control is to prevent that first stage: keep Chrome fully current, avoid untrusted sites, and in managed environments use enterprise policies to restrict browsing to trusted destinations - with the trade-off of reduced usability. Disabling passkeys/WebAuthn is not a supported per-feature toggle and would break legitimate strong-authentication flows, so patching is the only reliable fix. Track the technical fix at https://issues.chromium.org/issues/516813184.