What is the CVSS score of CVE-2026-17695?

CVE-2026-17695 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17695?

A critical privilege escalation flaw in Chrome's graphics rendering on macOS exposes any employee browsing the web to complete device compromise from a single malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-17695?

Within 24 hours, communicate the vulnerability to all macOS users and advise immediate Chrome updates. Within 7 days, deploy mandatory Chrome version 151.0.7922.72 or later across all macOS endpoints using your device management system (MDM, Intune, or Jamf), prioritizing any systems currently running versions prior to 151.0.7922.72. Within 30 days, verify 100% compliance through endpoint telemetry and document patch deployment records; audit for any suspicious activity on updated systems and review browser history for potential exploitation indicators on systems that delayed patching.

Google Chrome CVE-2026-17695

EUVD-2026-50821 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-rhr6-p3mg-3gqm

Google Information Disclosure Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs only a user visit (UI:R, PR:N, AC:L); sandbox escape crosses the security boundary (S:C) yielding full host C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:37 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Deliver malicious WebGL/GPU content

Exploit

Trigger inappropriate implementation in ANGLE

Execution

Escape renderer sandbox on macOS

Impact

Gain higher-privilege code execution on host

Access

Lure victim to crafted HTML page

Delivery

Deliver malicious WebGL/GPU content

Exploit

Trigger inappropriate implementation in ANGLE

Execution

Escape renderer sandbox on macOS

Impact

Gain higher-privilege code execution on host

Vulnerability AssessmentAI

Exploitation	Requires the victim to load a crafted HTML page in a vulnerable Google Chrome (before 151.0.7922.72) on macOS - user interaction (UI:R) is mandatory, so there is no zero-click path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals here are partially in tension and warrant judgment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts or injects a malicious web page containing crafted WebGL/graphics content that abuses the ANGLE implementation flaw; a macOS user running a vulnerable Chrome merely visits the page (via phishing link, malvertising, or compromised site) and the content triggers a sandbox escape from the renderer. Because AC is low and no privileges are needed beyond the victim opening the page, delivery is straightforward, though in practice this primitive is typically chained with a renderer bug for full code execution. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so ensure the update is applied and fully relaunch the browser to load the patched binary, then verify via chrome://version. … Detailed patch versions, workarounds, and compensating controls in full report.