What is the CVSS score of CVE-2026-17722?

CVE-2026-17722 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17722?

Google Chrome's Android WebView contains a sandbox escape vulnerability (CVE-2026-17722) affecting versions prior to 151.0.7922.72.. A patch is available.

How to fix or mitigate CVE-2026-17722?

Within 24 hours, audit your Android device inventory using mobile device management tools to identify Chrome versions currently deployed. Within 7 days, push Chrome 151.0.7922.72 or later to all Android devices through your MDM platform, prioritizing business-critical applications. Within 30 days, verify patch deployment rates have reached 95% or higher and configure alerting for any exploitation attempts through your SIEM.

Google Chrome CVE-2026-17722

EUVD-2026-50848 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-3rr2-3mr9-ff26

Information Disclosure Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page (AV:N, UI:R) but requires a prior renderer compromise, making it hard to chain (AC:H); the sandbox escape crosses a trust boundary (S:C) with full browser-process impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:34 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

8.3 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.3

DescriptionCVE.org

Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.

Technical ContextAI

The vulnerability lives in Android WebView, the system component built on the Chromium engine that renders web content inside native Android apps and the Chrome browser. Chromium enforces a multi-process security model in which untrusted web content runs in a low-privilege, sandboxed renderer process isolated from the more privileged browser process. CWE-416 (Use-After-Free) here is described as an 'object lifecycle issue': an object is freed while a reference to it remains reachable, so subsequent access operates on reclaimed or attacker-controlled memory. When triggered across the renderer/browser trust boundary, such memory corruption can be leveraged to escape the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome, with the Android WebView code path being the specific attack surface.

RemediationAI

Vendor-released patch: update Google Chrome and Android System WebView to 151.0.7922.72 or later, which is the primary and recommended fix. On Android these components update through Google Play, so ensure automatic app updates are enabled and force-update the Android System WebView and Chrome apps across managed fleets via MDM. If immediate patching is not possible, the practical compensating control is to reduce exposure to untrusted web content by restricting browsing to trusted sites and limiting installation of apps that render arbitrary remote HTML in WebView, accepting the usability trade-off of reduced browsing freedom; note that because this bug requires a prior renderer compromise, keeping the browser fully patched also closes the renderer-stage bugs needed to chain into it. Consult the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) for authoritative version guidance.