What is the CVSS score of CVE-2026-17729?

CVE-2026-17729 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17729?

Google Chrome (versions prior to 151.0.7922.72) contains a memory corruption vulnerability in its V8 JavaScript engine that could enable attackers to escalate access if a browser's renderer process…. A patch is available.

How to fix or mitigate CVE-2026-17729?

Within 24 hours, assess the scope of Chrome deployments across your environment through endpoint management tools. Within 7 days, begin staged deployment of Chrome 151.0.7922.72 or later, prioritizing user systems and high-value targets that may face targeted attacks. Complete organization-wide deployment within 30 days and verify updates through your device management platform.

Google Chrome CVE-2026-17729

EUVD-2026-50680 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-pxrm-m7rv-pmgg

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Renderer pre-compromise is an explicit, non-trivial attack precondition warranting AC:H; network delivery and user interaction remain required, with full impact if conditions are met.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:42 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.

Technical ContextAI

V8 is Google Chrome's open-source JavaScript and WebAssembly engine, responsible for parsing and executing JavaScript content from untrusted web pages inside a sandboxed renderer process. CWE-416 (Use After Free) describes a memory safety flaw where a program retains a pointer to heap memory after that memory has been freed and deallocated; subsequent dereference of the stale pointer leads to undefined behavior, typically manifesting as arbitrary read or write primitives exploitable for code execution or memory corruption. In browser engines, UAF bugs in V8 are particularly high-value because the JavaScript heap is attacker-controlled, enabling precise heap grooming to place attacker-crafted objects at the freed memory address. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all desktop platform builds of Chrome prior to the patched release. The multi-process architecture of Chrome means the renderer is isolated by a sandbox; this vulnerability operates within that renderer context and requires renderer access to exploit, consistent with tags indicating memory corruption and denial-of-service potential alongside code execution.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism typically applies this patch within hours of release; enterprise administrators should verify deployment through group policy reporting or device management platforms to confirm all endpoints are updated. If patching is delayed, enabling Chrome's Enhanced Safe Browsing can reduce the likelihood of users navigating to attacker-controlled pages that could trigger this in a chained attack. Restricting access to unknown or untrusted web destinations via DNS filtering or proxy allowlists also reduces the delivery surface for the crafted HTML page required to trigger exploitation. Enforcing Chrome's site isolation policy (already default in recent versions) limits the blast radius of any renderer compromise that might precede this exploit. Note that none of these compensating controls eliminate the underlying vulnerability - patching to 151.0.7922.72 remains the definitive fix.