What is the CVSS score of CVE-2026-17684?

CVE-2026-17684 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Chrome for iOS are affected by CVE-2026-17684?

Google Chrome for iOS contains a critical sandbox-escape vulnerability that could allow attackers to escalate a contained browser compromise into full device takeover, risking exposure of corporate…. A patch is available.

How to fix or mitigate CVE-2026-17684?

Within 24 hours, alert device owners and IT teams of the critical Chrome 151.0.7922.72 update availability and enforce installation through MDM if available. Within 7 days, verify that Chrome auto-update is enabled on all iOS devices and confirm that users have upgraded to version 151.0.7922.72 through app store records or device compliance tools. Within 30 days, audit adoption rates to achieve at least 95% coverage, review any renderer process crash logs for exploitation indicators, and conduct a security posture review of your iOS Chrome deployment and sandboxing controls.

Chrome for iOS CVE-2026-17684

EUVD-2026-50810 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-pwgg-jhvp-wr6h

Information Disclosure Google Apple

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered crafted page (AV:N/UI:R) escaping the renderer sandbox is a genuine trust-boundary crossing (S:C) with full C/I/A; PR kept N to match vendor convention despite the renderer-compromise prerequisite.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.

Technical ContextAI

The affected component is Google Chrome's iOS build (cpe:2.3:a:google:chrome), which runs the Blink/rendering engine inside a sandboxed renderer process isolated from the more privileged browser process and the underlying OS. CWE-20 (Improper Input Validation) here means a boundary that accepts data from the untrusted renderer fails to sufficiently validate it, so a renderer that is already under attacker control can send malformed input that the higher-privilege side mishandles, enabling a sandbox escape. The CVSS Scope:Changed flag reflects exactly this trust-boundary crossing: the exploited component (renderer) and the impacted component (browser process/OS resources) are different security authorities. On iOS specifically, Chrome relies on Apple's WebKit/WKWebView constraints in addition to Chromium's own multiprocess sandbox, so the practical impact of an escape depends on the surrounding platform isolation.

RemediationAI

Vendor-released patch: update Google Chrome for iOS to 151.0.7922.72 or later via the Apple App Store; this is the primary and complete fix, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, push the update through MDM app-management policies and enable automatic App Store updates to shorten exposure. Because exploitation requires a prior renderer compromise, interim risk reduction focuses on preventing that first stage: keep the OS and any WebKit components current, avoid untrusted sites, and where policy allows restrict browsing to trusted destinations - with the trade-off that aggressive URL filtering degrades usability and does not address an already-compromised renderer. There is no feature-level toggle that disables the vulnerable code path without patching, so upgrading is the only reliable control.