What is the CVSS score of CVE-2026-17726?

CVE-2026-17726 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17726?

Google Chrome for Android versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could allow attackers to gain unauthorized access to mobile devices if users visit a…. A patch is available.

How to fix or mitigate CVE-2026-17726?

Within 24 hours, issue an urgent security notice to all Android users identifying vulnerable Chrome versions and directing immediate update to 151.0.7922.72 or later; begin patch testing in staging environments simultaneously. Within 7 days, deploy Chrome version 151.0.7922.72 to all managed Android devices via your mobile device management platform, prioritizing corporate-owned equipment. Within 30 days, complete a full compliance audit to verify all devices have been updated, investigate any non-compliant devices, and document remediation actions for compliance records.

Google Chrome CVE-2026-17726

EUVD-2026-50675 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-30 Chrome

GHSA-w7ph-97wc-q2jr

Buffer Overflow Google Integer Overflow

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote, unauthenticated, but needs the victim to visit a page (UI:R) and reliable sandbox-escape chaining of an integer overflow raises complexity (AC:H); sandbox escape justifies S:C with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:30 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.

Technical ContextAI

The flaw lives in WebGL, the browser API that exposes GPU-accelerated 2D/3D rendering (based on OpenGL ES) to untrusted JavaScript inside the renderer process. The root cause is CWE-190 (Integer Overflow or Wraparound): a size, index, or length calculation in WebGL wraps around its integer bounds, which typically leads to undersized buffer allocation and subsequent out-of-bounds memory access - consistent with the 'Buffer Overflow' and 'Integer Overflow' tags. Because WebGL bridges the sandboxed renderer and lower-level GPU/graphics handling, a memory-corruption primitive here can be leveraged toward a sandbox escape rather than mere renderer compromise. Per the CPE (cpe:2.3:a:google:chrome), the affected product is the Chrome application, specifically the Android build below 151.0.7922.72.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome on Android to 151.0.7922.72 or later via the Play Store, and ensure desktop/other channels are on the corresponding Stable update per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates for most users, so verify the version in Settings > About and restart the browser to apply a pending update. If patching is delayed, the practical compensating control is to reduce exposure to untrusted WebGL content: disabling hardware acceleration or WebGL (via chrome://flags / enterprise policy) shrinks the attack surface but breaks GPU-accelerated sites and 3D content, and enterprise fleet management (Chrome Browser Cloud Management) can force the update to close the window quickly. There is no need to change ports or endpoints - this is a client-side browser flaw remediated purely by upgrading.