What is the CVSS score of CVE-2026-17712?

CVE-2026-17712 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17712?

Google Chrome on macOS versions before 151.0.7922.72 contains a high-severity remote code execution vulnerability in the Skia graphics library that can be triggered through crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-17712?

Within 24 hours, identify all macOS systems running Chrome versions prior to 151.0.7922.72 through endpoint management or browser telemetry. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected macOS systems via your standard patching workflow; enable or verify auto-update settings are functioning to accelerate deployment. Within 30 days, validate 100% patch deployment compliance across all inventoried systems and review access logs for any suspicious activity from the vulnerability exposure period.

Google Chrome CVE-2026-17712

EUVD-2026-50838 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-w8rv-f4mw-5237

RCE Google Race Condition

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via a malicious page (AV:N, UI:R, PR:N); AC:H because winning a Skia race is timing-dependent and non-deterministic; S:U since code stays inside the sandbox.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:36 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.

Technical ContextAI

Skia is Chromium's 2D graphics rasterization engine used to render web content (Canvas, CSS, SVG, and general page compositing). The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., a race condition), where concurrently executing Skia code paths access shared state without correct synchronization, producing a memory-safety corruption (such as a use-after-free or type confusion window) that is exploitable for code execution. The affected component is the browser's rendering pipeline on the macOS platform specifically; per the description the resulting code execution occurs inside the renderer sandbox rather than as a full sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to the fixed build).

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the stable channel (Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome applies fixes only after relaunch. In managed fleets, push the update through MDM/enterprise policy and verify the running build via chrome://settings/help. Because the vulnerability requires loading attacker-controlled web content, an interim compensating control is to restrict browsing to trusted sites and enforce Chrome's Site Isolation and sandbox (both default-on; do not disable them) until the update is deployed; note that these controls reduce but do not eliminate exposure, so patching remains the definitive fix.