What is the CVSS score of CVE-2026-17701?

CVE-2026-17701 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17701?

Google Chrome on macOS contains a critical sandbox escape vulnerability (CVE-2026-17701) that could allow an attacker to elevate from browser compromise to full system control.. A patch is available.

How to fix or mitigate CVE-2026-17701?

Within 24 hours, identify all macOS devices running Chrome versions prior to 151.0.7922.72 and notify users to avoid browser use on sensitive tasks until patching completes; communicate patch timeline to leadership. Within 7 days, deploy Chrome 151.0.7922.72 or later organization-wide using your endpoint management system or enterprise update channels. Within 30 days, audit compliance across all macOS endpoints using your vulnerability scanner or MDM tooling to confirm patch installation and flag any systems remaining on vulnerable versions.

Google Chrome CVE-2026-17701

EUVD-2026-50827 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-h6fh-j6x4-3pq7

Buffer Overflow Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N/UI:R for the malicious page, but AC:H because success requires a chained prior renderer compromise; S:C reflects the sandbox escape and C/I/A:H reflect total technical impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:31 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).

Technical ContextAI

The flaw resides in ANGLE (Almost Native Graphics Layer Engine), Chrome's abstraction library that translates WebGL/OpenGL ES calls onto native GPU backends - on macOS this maps to Metal/OpenGL. ANGLE runs at the boundary between the sandboxed renderer and the more-privileged GPU/browser process, so a memory-safety bug here is a classic sandbox-escape primitive. NVD classifies the root cause as CWE-125 (out-of-bounds read), while the input tags additionally reference Buffer Overflow and Information Disclosure, consistent with insufficient validation of untrusted input allowing reads (and potentially further corruption) outside intended buffer bounds. The only affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the macOS build.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so verify the running version under chrome://settings/help and relaunch to apply. There is no separate documented workaround, but because exploitation requires a first-stage renderer compromise, meaningful compensating controls until patching completes include reducing renderer attack surface - enforce Chrome's Enhanced/Strict Site Isolation (default) and disable unnecessary WebGL/hardware acceleration via enterprise policy (chrome://settings, HardwareAccelerationModeEnabled=false), accepting the trade-off of degraded graphics performance for WebGL-dependent sites. Managed fleets should push the updated version through MDM/enterprise policy to guarantee coverage rather than relying on per-user auto-update.