What is the CVSS score of CVE-2026-17719?

CVE-2026-17719 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17719?

A remote code execution flaw in Google Chrome could enable unauthorized access to user browsers and organizational data through malicious webpages without requiring users to be authenticated or take…. A patch is available.

How to fix or mitigate CVE-2026-17719?

Within 24 hours, inventory all Chrome desktop deployments across the organization, communicate the vulnerability and mandatory patch deadline to affected users, and verify your current version distribution in the environment. Deploy Chrome 151.0.7922.72 or later to 100% of systems within 7 days, using your established update mechanism-whether automatic updates, mobile device management, or centralized patch deployment-and document any systems that cannot be patched immediately. By day 30, audit patch compliance across the full environment, resolve any remaining deployment gaps, and reinforce automatic browser update policies to prevent future delays on critical security updates.

Google Chrome CVE-2026-17719

EUVD-2026-50845 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-42w5-9cqv-wq6x

Google Use After Free RCE Denial Of Service Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page requires the user to visit it (UI:R) with no auth (PR:N); renderer-only execution keeps scope unchanged (S:U) with high C/I/A within the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:24 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

JavaScript grooms renderer heap

Exploit

Trigger use-after-free in Input component

Execution

Reclaim freed object with controlled data

Impact

Execute arbitrary code in renderer sandbox

Access

Lure victim to crafted HTML page

Delivery

JavaScript grooms renderer heap

Exploit

Trigger use-after-free in Input component

Execution

Reclaim freed object with controlled data

Impact

Execute arbitrary code in renderer sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively open or navigate to an attacker-controlled HTML page in a vulnerable Chrome build (before 151.0.7922.72) - this user interaction (UI:R) is the primary limiting factor; there is no drive-by-without-interaction or authentication requirement (PR:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, low-complexity bug needing only that a user open a page, with full confidentiality/integrity/availability impact within the unchanged scope of the renderer. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted HTML/JavaScript that grooms the heap and triggers the use-after-free in Chrome's Input handling, then delivers the link via phishing, malvertising, or a compromised site. When a victim running a pre-151.0.7922.72 Chrome opens the page, the attacker gains arbitrary code execution within the renderer sandbox. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so restart the browser to apply the pending update and verify via chrome://settings/help. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Chrome desktop deployments across the organization, communicate the vulnerability and mandatory patch deadline to affected users, and verify your current version distribution in the environment. …

Threat intelligence, references, and detailed analysis are available after sign-in.