What is the CVSS score of CVE-2026-17717?

CVE-2026-17717 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17717?

Google Chrome desktop (versions prior to 151.0.7922.72) contains a critical sandbox escape in the ANGLE graphics layer that could allow a malicious webpage to compromise system integrity.. A patch is available.

How to fix or mitigate CVE-2026-17717?

Within 24 hours, inventory Chrome desktop deployment scope across the organization and initiate staged rollout planning for version 151.0.7922.72 or later, with priority to systems handling sensitive data and privileged users. Within 7 days, deploy the patched version to critical user populations, development teams, and test environments while validating for application compatibility. Complete full organizational deployment by day 30 to ensure all Chrome desktop users receive the sandbox escape mitigation and verify rollout via deployment logs or asset management systems.

Google Chrome CVE-2026-17717

EUVD-2026-50843 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-30 Chrome

GHSA-x743-xhcc-5xqf

Buffer Overflow Google Integer Overflow

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page with UI:R; AC:H because reliable sandbox escape realistically requires chaining and precise heap grooming; S:C reflects the renderer-boundary crossing with total impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:39 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls into the platform's native graphics API (Direct3D, Metal, Vulkan, or desktop OpenGL). It runs partly in the GPU process, which sits at a higher privilege boundary than the sandboxed renderer, so memory-safety bugs here are especially dangerous. The root cause is CWE-190 (Integer Overflow or Wraparound): an arithmetic operation - likely a size, offset, or buffer-length calculation for graphics data supplied via WebGL - wraps around, producing an undersized allocation or out-of-bounds access. The affected CPE is cpe:2.3:a:google:chrome across all versions below the fix, i.e. the desktop browser itself rather than a single OS build.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72 - update to this version or later via the stable channel and restart the browser to apply, verifying under chrome://settings/help. In managed environments, push the update through your enterprise deployment tooling and confirm auto-update is not disabled, since the fix is only effective after the relaunch that swaps the running ANGLE code. Users of other Chromium-based browsers should apply the corresponding vendor build once it rebases onto the fixed ANGLE. As an interim compensating control before patching, WebGL can be disabled or restricted (e.g. via enterprise policy or by hardening GPU acceleration), which removes the ANGLE attack surface but breaks legitimate 3D/WebGL and some canvas-accelerated sites; this is a meaningful usability trade-off and should be temporary. See the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.