What is the CVSS score of CVE-2026-17699?

CVE-2026-17699 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17699?

Google Chrome desktop versions prior to 151.0.7922.72 contain a vulnerability in the rendering engine that permits local attackers to bypass Chrome's sandbox isolation.. A patch is available.

How to fix or mitigate CVE-2026-17699?

Within 24 hours, scan your organization for Chrome versions prior to 151.0.7922.72 and create a deployment plan prioritizing systems with elevated access or sensitive data handling. Within 7 days, deploy Chrome 151.0.7922.72 stable channel or later through your established patch management process to all affected systems. By day 30, complete rollout across all endpoints, generate version compliance reports to confirm deployment success, and document any systems requiring exception reviews.

Google Chrome CVE-2026-17699

EUVD-2026-50825 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-49qh-vm7v-wv5w

Denial Of Service Google Use After Free Memory Corruption

8.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local malicious-file vector with required user interaction (AV:L/UI:R), no prior privileges (PR:N), and a sandbox escape crossing a trust boundary yields scope change with high C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.9 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:36 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.6 (None) 8.6 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.6

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chromium's Views, the C++ UI toolkit that renders Chrome's native windows, menus, and browser chrome. Use-after-free bugs occur when a pointer to a freed heap object is subsequently dereferenced, allowing an attacker to reclaim that memory with controlled data and hijack object behavior (e.g., corrupting vtable pointers). Because Views runs in the higher-privileged browser process rather than the sandboxed renderer, corrupting its state is a path to escaping Chrome's sandbox. The affected component is identified only as cpe:2.3:a:google:chrome:*, i.e., Google Chrome across versions prior to the fix.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and verify the version via chrome://settings/help. The authoritative advisory is Google's stable-channel update post (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Because exploitation requires the user to open a malicious file, interim compensating controls until patching completes include instructing users not to open untrusted files delivered via Chrome and enforcing enterprise auto-update policies to shorten the exposure window; these have minimal functional trade-offs. Downstream Chromium-based browsers should be updated to a build incorporating the equivalent Views fix once their vendors publish it.