What is the CVSS score of CVE-2026-17727?

CVE-2026-17727 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17727?

Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) contains a memory corruption vulnerability (CVE-2026-17727) enabling remote code execution when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-17727?

Within 24 hours: inventory Chrome versions on managed and personal Android devices, verify auto-update is enabled fleet-wide, and assess control over BYOD Chrome updates. Within 7 days: push Chrome 151.0.7922.72 or later to all managed Android devices via your MDM platform and communicate severity to users on unmanaged devices; prioritize employees accessing sensitive data on mobile. Within 30 days: confirm 95%+ adoption of Chrome 151.0.7922.72 or later across your Android estate, review browser logs and endpoint detection for malformed WebGL requests or renderer process crashes, and document any exploitation indicators in your incident response logs.

Google Chrome CVE-2026-17727

EUVD-2026-50676 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-30 Chrome

GHSA-q979-p6rc-5p76

Buffer Overflow Google Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page with no privileges but required user interaction (UI:R); sandbox escape breaks the renderer boundary (S:C) with full memory-corruption-driven C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:30 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.

Technical ContextAI

The flaw resides in WebGL, the browser API that exposes GPU-accelerated 3D graphics (based on OpenGL ES) to JavaScript running inside a web page. WebGL processes untrusted geometry, shader, and buffer data in the renderer process, making it a historically rich source of memory-safety bugs. The root cause is classified as CWE-787 (Out-of-bounds Write), meaning attacker-controlled input drives a write past the bounds of an allocated buffer - corrupting adjacent memory. Because a successful corruption here is described as enabling a sandbox escape, the defect undermines the renderer sandbox boundary that normally confines compromised web content. The affected component is Google Chrome (CPE cpe:2.3:a:google:chrome), specifically the Android build prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome for Android to 151.0.7922.72 or later, as delivered through the Google Play Store stable channel per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Ensure automatic app updates are enabled on managed Android devices so the fixed build rolls out without user action, and verify the running version via chrome://version. If immediate patching is not possible, the primary compensating control is to disable WebGL by navigating to chrome://flags and turning off WebGL/hardware acceleration, or blocking the attack surface via enterprise policy - the trade-off is that WebGL-dependent sites (maps, 3D viewers, some games and dashboards) will fail to render. Additionally, restrict browsing to trusted sites and use content filtering to reduce exposure to crafted pages until the update is applied.