What is the CVSS score of CVE-2026-17694?

CVE-2026-17694 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17694?

A use-after-free vulnerability in Google Chrome (CVE-2026-17694, CVSS 8.8) enables remote code execution when users visit attacker-controlled websites.. A patch is available.

How to fix or mitigate CVE-2026-17694?

Within 24 hours, notify IT and device management teams to assess Chrome deployment scope and communicate security alert to end-users emphasizing browsing safety while patches roll out. Within 7 days, push Chrome 151.0.7922.72 or later via endpoint management systems (Windows Update, managed software distribution, Linux package managers) and verify deployment to 95%+ of Chrome-using devices. Within 30 days, achieve 100% remediation by targeting remaining unpatched users, audit browser security logs for DOM-based attack indicators, and notify affected users of any exploitation detected.

Google Chrome CVE-2026-17694

EUVD-2026-50820 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-xwr8-52r2-77wh

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N/AC:L/PR:N) requiring the victim to open it (UI:R); renderer-sandbox execution keeps scope unchanged (S:U) with high C/I/A in-process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's DOM engine (Blink), the component that parses HTML and maintains the live in-memory Document Object Model. Use-after-free occurs when C++ code retains and dereferences a pointer to a DOM object (node, element, or associated allocation) after it has been freed - typically triggered by script-driven mutation, event callbacks, or garbage-collection timing during page rendering. An attacker who controls the freed-then-reused memory can groom the heap to place attacker-controlled data where a dangling pointer is dereferenced, converting the dangling reference into a controlled read/write and ultimately code execution in the renderer process. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e., the Google Chrome desktop browser on the Stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staged updates do not take effect until relaunch. In managed fleets, push the update via Chrome Browser Cloud Management / group policy and force a relaunch to guarantee the vulnerable process is retired. If immediate patching is not possible, reduce exposure by limiting browsing to trusted sites, enabling Chrome's Enhanced Safe Browsing (which adds real-time malicious-page checks at the cost of sending more telemetry to Google), and considering site-isolation/strict rendering policies - but note none of these are a substitute for the fix, since the trigger is simply loading a crafted HTML page. For Chromium-based derivatives, apply the corresponding upstream-based release from that vendor once available.