What is the CVSS score of CVE-2026-17688?

CVE-2026-17688 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17688?

A critical vulnerability in Google Chrome (CVE-2026-17688, CVSS 9.6) could allow attackers who have already compromised the browser to escalate their access to the host operating system, potentially…. A patch is available.

How to fix or mitigate CVE-2026-17688?

Within 24 hours, audit Chrome version distribution across the organization and establish an update timeline. Within 7 days, deploy Chrome 151.0.7922.72 or later to all systems running versions before 151.0.7922.72, prioritizing endpoints with access to sensitive systems or data. Within 30 days, verify patch deployment completion across all endpoints and review security logs for any exploitation attempts.

Google Chrome CVE-2026-17688

EUVD-2026-50814 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-jfrf-4g9q-hwqj

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network vector with user interaction to load a page, but AC:H because a prior renderer compromise and heap grooming are required; scope changes (S:C) as the browser process is escaped with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:40 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Input subsystem, the browser-process component that processes input events and related IPC from renderer processes. Use-after-free occurs when a pointer to freed memory is reused, allowing an attacker who controls allocation timing and heap layout to reclaim the freed object and manipulate its state, typically yielding controlled memory corruption and code execution. Because the vulnerable code runs in the higher-privileged browser process (S:C, scope change), successful exploitation crosses the renderer/browser trust boundary that Chrome's multi-process sandbox is designed to enforce. Per CPE cpe:2.3:a:google:chrome, all Chrome desktop builds prior to the fixed 151.0.7922.72 are affected across platforms.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (chrome://settings/help) and relaunch to apply, as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Enterprises should push the update through managed browser policies and verify the version fleet-wide, since Chrome's silent-update mechanism can be blocked by pinned versions or restricted network egress. If immediate patching is not possible, reduce the renderer-compromise prerequisite this bug depends on: enforce Site Isolation (default on), keep the sandbox enabled (never launch with --no-sandbox), and restrict browsing to trusted sites via URL allowlisting or remote browser isolation for high-risk users - the trade-off is reduced usability and residual exposure to any allowlisted-but-compromised site. There is no standalone toggle for the Input component, so upgrading is the only complete fix.