What is the CVSS score of CVE-2026-17721?

CVE-2026-17721 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17721?

Google Chrome desktop browsers versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability that could enable attackers to fully compromise affected systems through malicious web…. A patch is available.

How to fix or mitigate CVE-2026-17721?

Within 24 hours, identify all Chrome desktop deployments and verify patch status for version 151.0.7922.72 or later; communicate the critical nature of this vulnerability to leadership and affected users. Within 7 days, deploy patch version 151.0.7922.72 or later across your Chrome desktop fleet using standard update mechanisms (GPO, MDM, or patch management tools), prioritizing business-critical systems and high-risk user populations. By day 30, achieve 100% compliance with the patched version and validate deployment through vulnerability scanning.

Google Chrome CVE-2026-17721

EUVD-2026-50847 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-30 Chrome

GHSA-m2x7-p454-5w3c

Buffer Overflow Google Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no auth (AV:N/PR:N) but requires the user to load it (UI:R); the sandbox escape crosses a trust boundary (S:C) with full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:23 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses to translate WebGL and OpenGL ES calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux/Android). It executes inside Chrome's GPU process, which is sandboxed but more privileged than the renderer for hardware access. The root cause is CWE-787 (Out-of-bounds Write): malformed graphics commands or shader/geometry data drive a write past the bounds of an allocated buffer, corrupting adjacent memory. Because ANGLE processes untrusted, web-supplied graphics data, a page can steer this corruption to achieve memory control within the GPU process and, per the advisory, escape the sandbox. The single affected CPE is cpe:2.3:a:google:chrome (all versions below 151.0.7922.72).

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel (verify through chrome://settings/help, which triggers the background updater, then relaunch the browser to apply it); managed fleets should push the update through their enterprise update policy or MDM. Details are in the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until the update is deployed, meaningful compensating controls are limited because the trigger is web content: you can disable hardware GPU acceleration (chrome://settings 'Use graphics acceleration when available', or the --disable-gpu / HardwareAccelerationModeEnabled=false policy) to reduce ANGLE's exposure, at the cost of degraded rendering performance and video decode; and you can restrict browsing to trusted sites via URL allowlisting, at the cost of user friction. Chromium-based browsers should be updated to the build that incorporates the upstream ANGLE fix once released.