What is the CVSS score of CVE-2026-17685?

CVE-2026-17685 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17685?

Google Chrome desktop versions before 151.0.7922.72 contain a vulnerability in the Autofill component that allows remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-17685?

Within 24 hours, audit your Chrome desktop deployment and communicate the urgent patch requirement to all users. Deploy Chrome version 151.0.7922.72 or later across all systems within 7 days using your managed update mechanism or by instructing users to self-update via Settings > About Chrome. Within 30 days, verify that at least 95% of systems have been patched, review access logs for exploitation indicators, and document your patch deployment for compliance purposes.

Google Chrome CVE-2026-17685

EUVD-2026-50811 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-f342-mcrf-wv9h

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no privileges but mandatory user navigation (UI:R); renderer-sandbox code execution keeps scope unchanged with full C/I/A on the compromised process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.

Technical ContextAI

The flaw lives in Chrome's Autofill subsystem, the browser feature that stores and injects saved form data (addresses, payment info, credentials) into web pages. Per CWE-416 (Use After Free), the root cause is a dangling pointer: memory backing an Autofill object is freed while a reference to it remains live, so subsequent access operates on reclaimed heap memory. An attacker who controls page content and DOM lifecycle events can groom the heap to place attacker-controlled data where the freed object was, converting the dangling reference into a controlled read/write primitive and ultimately code execution. The CPE cpe:2.3:a:google:chrome identifies the affected product as the Chrome application across all builds prior to the fixed release; the impact is bounded to code execution inside the renderer sandbox rather than the host OS absent a separate sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel; verify via chrome://settings/help which forces an update check and relaunch. In managed fleets, ensure Chrome auto-update is enabled and push the release through your management console (GPO/Jamf/Intune) rather than relying on user relaunch, then confirm the running version across endpoints. As an interim compensating control before update rollout completes, disabling Autofill (chrome://settings/autofill - turn off addresses, payment methods, and password autofill) reduces exposure to the vulnerable code path, at the cost of user convenience and re-entry of form data; restricting browsing to trusted sites and pushing the update as high priority further limits the window. Users of Chromium-based browsers should apply their vendor's build incorporating the equivalent Chromium fix. Advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.