What is the CVSS score of CVE-2026-17697?

CVE-2026-17697 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17697?

Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17697) capable of compromising employee systems through malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-17697?

Within 24 hours, enable automatic updates for Chrome and notify all employees to update to version 151.0.7922.72 or later; verify that auto-update is not blocked by security software or policies. Within 7 days, use endpoint management tools or browser telemetry to inventory all Chrome installations and confirm that 100% have been updated to version 151.0.7922.72 or later. Within 30 days, audit Chrome deployment policies across the organization to ensure automatic patching is enabled and establish escalation procedures for future critical browser vulnerabilities.

Google Chrome CVE-2026-17697

EUVD-2026-50823 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-g9r6-47g2-3cpc

Information Disclosure Google Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); a sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:37 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL/OpenGL ES calls onto the host's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because it processes attacker-influenced GPU/shader content and runs partly in the more-privileged GPU process, memory-safety bugs here are a classic sandbox-escape surface. The root cause is CWE-843 Type Confusion: code interprets a memory object as an incompatible type, allowing out-of-bounds or otherwise corrupted access that can be steered toward code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome (all builds before the fixed release) across desktop platforms.

RemediationAI

Update Chrome to 151.0.7922.72 or later (Vendor-released patch: 151.0.7922.72); patch is available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome normally auto-updates, so verify via chrome://settings/help and relaunch to apply, and push the update through enterprise management (e.g. Chrome Browser Cloud Management / group policy) to fleet endpoints. Until the update is deployed, reduce exposure to untrusted web content; as a targeted mitigation you can disable GPU/hardware acceleration (chrome://settings - 'Use graphics acceleration when available', or the --disable-gpu flag) to shrink the ANGLE attack surface, at the cost of degraded rendering/video performance and battery life. Users of other Chromium-based browsers should apply their vendor's equivalent update once released.