What is the CVSS score of CVE-2026-17718?

CVE-2026-17718 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17718?

Google Chrome versions prior to 151.0.7922.72 contain a critical vulnerability allowing remote code execution on user endpoints through a single malicious webpage.. A patch is available.

How to fix or mitigate CVE-2026-17718?

Within 24 hours, inventory Chrome versions deployed across all endpoints and verify patch 151.0.7922.72 availability through your distribution channels. Within 7 days, deploy Chrome 151.0.7922.72 or later organization-wide via mobile device management (MDM) or patch management platform, prioritizing user-facing workstations and systems processing confidential data. Within 30 days, confirm via endpoint telemetry or MDM reporting that 100% of Chrome instances have been updated to 151.0.7922.72 or later.

Google Chrome CVE-2026-17718

EUVD-2026-50844 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-p4j8-jw78-gvc8

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via a crafted page (AV:N, UI:R, PR:N) with a renderer-to-host scope change; AC:H because reliable use-after-free sandbox escapes require precise heap grooming.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.

Technical ContextAI

The flaw lives in ANGLE (Almost Native Graphics Layer Engine), Chrome's translation layer that maps OpenGL ES / WebGL calls onto the host platform's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced GPU commands originating from web content, a memory-safety defect here is reachable from any rendered page. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains, and subsequent access to that freed memory can corrupt the heap. In Chrome's multi-process model this component runs with enough privilege that corrupting it can pivot out of the renderer, which is why the CVSS scope is marked Changed (S:C).

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel per the Chrome release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most environments receive this via Chrome's automatic updater, so verify the update actually applied and relaunch the browser to complete it, since Chrome does not swap the running binary until restart. In managed fleets, push the update through your enterprise policy/MDM and confirm version compliance. As an interim compensating control before patching, you can reduce ANGLE/WebGL attack surface by disabling hardware acceleration or WebGL (chrome://settings or the WebGLDisabled / policy controls) - trade-off: this degrades graphics performance and breaks WebGL/3D content and some video features. Users of other Chromium-based browsers should apply the equivalent vendor update once released.