What is the CVSS score of CVE-2026-17738?

CVE-2026-17738 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17738?

Google Chrome's Payments component (versions prior to 151.0.7922.72) contains a critical sandbox escape vulnerability affecting all Chrome users within the organization.. A patch is available.

How to fix or mitigate CVE-2026-17738?

Within 24 hours, audit current Chrome deployment versions across all endpoints to identify installations running versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected instances, prioritizing systems with elevated privileges or sensitive data access. By day 30, complete verification that 100% of Chrome instances have been updated through automated endpoint management tools and vulnerability scanning.

Google Chrome CVE-2026-17738

EUVD-2026-50688 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-qwx8-w8ww-92jg

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

PR:H and AC:H reflect the required prior renderer compromise and chaining; UI:R for the page load and S:C plus C/I/A:H for the full sandbox escape are retained.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:40 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Payments component before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox by serving a crafted HTML page, driven by insufficient validation of untrusted input (CWE-20). Google rates the Chromium security severity as Medium, but the assigned CVSS is 9.6 due to the scope-changing sandbox escape. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21%.

Technical ContextAI

The flaw lives in Chrome's Payments subsystem, part of the Blink/Chromium renderer that handles the Payment Request and related web payment APIs. Chromium's multi-process security model confines untrusted web content to a low-privilege renderer sandbox; a sandbox escape means crossing from that renderer into the higher-privileged browser process, which is why the CVSS scope is Changed (S:C). The root cause is CWE-20 (Improper Input Validation): the Payments code accepts input from the already-untrusted renderer without sufficient validation, allowing that input to influence privileged behavior. The affected component is the desktop Chrome browser (CPE cpe:2.3:a:google:chrome), which shares the Chromium engine with Edge, Brave, Opera and other Chromium-based browsers that may inherit the same defect.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and restart the browser to apply the update, since Chrome staging holds the old binary until relaunch. In managed environments, confirm auto-update is enabled and push the update via your enterprise management tooling. Users of other Chromium-based browsers should apply their vendor's build that incorporates the corresponding Chromium fix. As an interim compensating control until the update lands, restrict use of untrusted/high-risk sites and deploy site isolation and enterprise browsing policies; note that because exploitation requires a prior renderer compromise, keeping the browser fully patched against renderer-level RCE is itself an effective mitigation for the chain. There is no supported feature toggle that cleanly disables only the vulnerable Payments path without breaking web payment functionality.