What is the CVSS score of CVE-2026-17687?

CVE-2026-17687 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17687?

Google Chrome contains a critical vulnerability affecting versions before 151.0.7922.72 that allows sandbox escape, potentially enabling full system compromise for any user on an affected version.. A patch is available.

How to fix or mitigate CVE-2026-17687?

Within 24 hours, inventory all Chrome deployments in your environment and communicate the mandatory patch requirement to users and IT teams. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all endpoints through your standard patch management process; prioritize end-user machines and critical systems. Within 30 days, verify patch compliance across the organization and update vulnerability tracking systems to confirm remediation.

Google Chrome CVE-2026-17687

EUVD-2026-50813 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-8m3j-qh2v-pc64

Information Disclosure Google Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Scored as a web-facing sandbox-escape chain component: network vector, user must load a page (UI:R), scope changes from renderer to host (S:C) with full C/I/A impact; PR:N retained per vendor scoring despite the renderer-compromise prerequisite.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction that translates WebGL / OpenGL ES calls from web content into the host platform's native graphics API (Direct3D, Metal, or Vulkan). Because it processes attacker-influenceable GPU commands in a more privileged process than the renderer, memory-safety defects in ANGLE are a classic sandbox-escape surface. The root cause here is CWE-843 (Type Confusion): code interprets a memory object as one type when it is actually another, enabling out-of-bounds reads/writes and controllable memory corruption. The single affected CPE, cpe:2.3:a:google:chrome:*, confirms the Chrome desktop browser as the affected product; the tags (Memory Corruption, Information Disclosure) align with type-confusion primitives that leak and corrupt memory.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel and restart the browser to apply it (see https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, push the update through your enterprise update policy / MDM and verify the running version afterward. If patching must be delayed, the practical compensating control is to reduce renderer-compromise exposure that this bug chains from: restrict browsing to trusted sites, deploy Chrome's site-isolation and enterprise hardening policies, and consider disabling GPU acceleration/WebGL for high-risk user groups (trade-off: degraded graphics/WebGL performance and possible breakage of GPU-dependent web apps). These are stopgaps only - the type-confusion fix requires the updated build.