What is the CVSS score of CVE-2026-17686?

CVE-2026-17686 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17686?

Google Chrome versions prior to 151.0.7922.72 contain a site isolation bypass vulnerability that could allow attackers to read and modify sensitive data across different websites.. A patch is available.

How to fix or mitigate CVE-2026-17686?

Within 24 hours: Deploy Chrome version 151.0.7922.72 or later to all endpoints through your organization's patch management system and verify auto-update is enabled. Within 7 days: Complete an inventory audit to confirm 100% of Chrome installations are running the patched version; use Chrome enterprise management policies to enforce updates where auto-update may have been disabled. Within 30 days: Review security logs for any indicators of renderer process compromise or suspicious cross-origin data access patterns that may have occurred prior to patching.

Google Chrome CVE-2026-17686

EUVD-2026-50812 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-v45v-wj9p-hx85

Authentication Bypass Google

8.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.4 MEDIUM

Requires a pre-compromised renderer foothold (PR:L) plus chained conditions (AC:H) and victim loading content (UI:R); yields high confidentiality/integrity loss with no availability impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.1

DescriptionCVE.org

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Site isolation bypass in Google Chrome prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process read or tamper with data belonging to other origins by serving a crafted HTML page, defeating one of Chrome's core sandbox boundaries. Chromium rates the severity High and a fixed Stable-channel build has shipped; there is no public exploit identified at time of analysis and EPSS is low at 0.30% (23rd percentile). The flaw is an input-validation weakness (CWE-20) in the Passwords component that undermines the per-site process separation guarantee.

Technical ContextAI

Site Isolation is Chrome's security architecture that places documents from different sites into separate renderer processes so that a single compromised renderer cannot reach cross-origin data such as saved credentials, cookies, or DOM content. This vulnerability lives in the Passwords subsystem and stems from insufficient validation of untrusted input (CWE-20), which allows a malicious document to cross the process/origin boundary that Site Isolation is meant to enforce. The affected code is the Chrome browser application itself (cpe:2.3:a:google:chrome), so the issue is in the browser engine (Chromium/Blink) rather than any external library, and it is exploitable only once an attacker controls a renderer, making it a boundary-hardening bug rather than an initial-access primitive.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72; upgrade all Desktop Chrome installations to 151.0.7922.72 or later and restart the browser to apply, verifying via chrome://settings/help and the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the update through your enterprise update policy or MDM and confirm auto-update is not disabled. Because exploitation requires a pre-compromised renderer, interim compensating controls should focus on reducing renderer-compromise exposure: keep Chrome auto-updates enabled, restrict high-risk browsing, and consider enabling stricter enterprise policies (for example Site Isolation enforcement and reduced use of unvetted extensions); note these reduce but do not eliminate exposure and are no substitute for the version upgrade.