What is the CVSS score of CVE-2026-17735?

CVE-2026-17735 has a contested CVSS base score of 8.7 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17735?

Google Chrome vulnerability (CVE-2026-17735) could allow attackers to compromise the browser process after initial access, affecting all Chrome users organization-wide and potentially exposing…. A patch is available.

How to fix or mitigate CVE-2026-17735?

Conduct an immediate inventory of Chrome deployments across the organization to identify endpoints requiring patching within 24 hours. Deploy Chrome version 151.0.7922.72 or later to all affected systems within 7 days, coordinating with endpoint management teams to minimize disruption. Within 30 days, validate patch deployment coverage, verify that no endpoints have rolled back to vulnerable versions, and confirm automated update mechanisms are functioning to prevent regression.

Google Chrome CVE-2026-17735

EUVD-2026-50685 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-xg37-cj68-xwq6

Information Disclosure Google

High

Disputed · 8.7 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.7 HIGH

AC raised to High because exploitation requires a prior renderer compromise as a chained precondition; all other metrics preserved from vendor scoring as the sandbox escape and impact are confirmed.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:35 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

8.7 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.7

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

BFCache in Google Chrome prior to 151.0.7922.72 contains insufficient input validation that enables a renderer-compromised attacker to escape Chrome's sandbox and execute code in the higher-privileged browser process via a crafted HTML page. The Scope:Changed metric in the CVSS vector (8.7) confirms the escape crosses the renderer-to-browser process boundary, yielding high confidentiality and integrity impact. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile) and SSVC rates exploitation as none and not automatable, consistent with the chained, technically demanding nature of this attack.

Technical ContextAI

BFCache (Back/Forward Cache) is Chrome's page-snapshot optimization that preserves the complete state of a navigated page-including JavaScript heap, DOM tree, and active network connections-to enable instant back/forward restoration without a full reload. Because BFCache must serialize and deserialize complex page state across navigation events, it must rigorously validate any data re-entering the rendering pipeline from the cache. CWE-20 (Improper Input Validation) identifies the root cause: crafted HTML can supply malicious cached state that BFCache passes back into privileged browser internals without adequate sanitization, allowing a compromised renderer to interact with the browser process in unintended ways. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome platform variants below the fixed release, per the EUVD-confirmed version range of any build preceding 151.0.7922.72.

RemediationAI

The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which resolves the BFCache input validation flaw; the vendor advisory is at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For most users, Chrome's built-in auto-update will deliver this automatically; enterprise administrators should verify deployment via Chrome Browser Cloud Management or group policy and confirm the update has applied by checking chrome://settings/help. As an interim compensating control where immediate patching is not feasible, administrators can disable BFCache via enterprise policy (set BackForwardCacheEnabled to false), which eliminates the vulnerable code path entirely at the cost of slower back/forward navigation performance for users. Because this vulnerability requires a prior renderer compromise to reach, ensuring Chrome's renderer sandbox and site isolation features are enforced at their default settings raises the bar for an attacker to even reach the BFCache flaw, providing defense-in-depth pending the patch.