What is the CVSS score of CVE-2026-17691?

CVE-2026-17691 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17691?

A critical vulnerability in Google Chrome for Windows (CVE-2026-17691) enables attackers to gain system-level access through malicious webpages, affecting all unpatched Windows endpoints across your…. A patch is available.

How to fix or mitigate CVE-2026-17691?

Within 24 hours, inventory all Windows systems running Chrome and identify versions prior to 151.0.7922.72; issue an urgent security alert to all users and IT teams emphasizing the critical nature and mandatory update requirement. Within 7 days, deploy Chrome 151.0.7922.72 or later to all Windows environments via your endpoint management platform (e.g., SCCM, Intune, or built-in Chrome auto-update); prioritize systems with sensitive data access and high-privilege users. Within 30 days, complete a security audit of patch deployment rates, confirm 100% compliance across the Windows estate, and monitor security logs for any exploitation attempts targeting this vulnerability.

Google Chrome CVE-2026-17691

EUVD-2026-50817 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-30 Chrome

GHSA-4c2c-vwch-6hm8

Buffer Overflow Google Memory Corruption Microsoft

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote via crafted page with no auth but required user interaction; AC:H reflects the non-trivial memory-corruption exploitation and 'potential' escape, with scope change and full impact on success.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL/OpenGL ES calls onto native backends such as Direct3D on Windows, making it directly reachable from untrusted web content via JavaScript/WebGL. The root cause is CWE-787 (Out-of-bounds Write): a memory-corruption condition where the code writes past the bounds of an allocated buffer, typically due to an unchecked index or length in graphics command/geometry processing. Because ANGLE runs in a context bridging the sandboxed renderer and lower-level graphics drivers, a controlled OOB write here is a classic primitive for corrupting adjacent memory and pivoting toward a sandbox escape. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, limited to the Windows platform per the description.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Stable channel; the fix is confirmed available per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Trigger 'Help > About Google Chrome' to force the update and fully relaunch the browser so the new binary loads, then verify enterprise fleets via your management console/GPO. Until patched, the practical compensating control is to reduce the attack surface of the vulnerable ANGLE/WebGL path - for example disabling hardware acceleration or restricting WebGL (chrome://flags or enterprise policies), which lowers exposure but degrades graphics performance and may break WebGL-dependent sites; avoid untrusted sites and consider strict site isolation and content filtering. Chromium-based browsers should be updated to builds that incorporate the equivalent ANGLE fix.