What is the CVSS score of CVE-2026-17741?

CVE-2026-17741 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17741?

Google Chrome's Android WebView contains a vulnerability that could allow attackers to bypass security protections on mobile devices when users visit crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-17741?

Within 24 hours, identify all Android devices in your environment running Chrome versions prior to 151.0.7922.72, including both managed devices and BYOD systems. Within 7 days, deploy Chrome version 151.0.7922.72 or later through your mobile device management solution and notify end users to update through the Google Play Store. Within 30 days, verify patch deployment across your device fleet and ensure at least 95% compliance, escalating outreach to any lagging systems.

Google Chrome CVE-2026-17741

EUVD-2026-50691 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-fp29-qv6c-wggp

Information Disclosure Google

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with Low C/I/A impact matching Chromium's Medium rating.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:23 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

7.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Android WebView (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox when a victim views a crafted HTML page. Rated Medium by Chromium and CVSS 7.1, it carries a scope-changing impact but requires user interaction; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating limited near-term mass exploitation likelihood.

Technical ContextAI

The affected component is Android WebView, the embeddable Chromium-based browser engine used by countless Android applications to render web content in-process. The root cause is classified as CWE-20 (Improper Input Validation): WebView insufficiently validates untrusted input (attacker-controlled HTML/DOM content), which can be leveraged to cross the renderer sandbox boundary that normally isolates web content from the underlying application and OS. Because the CVSS scope is Changed (S:C), a successful exploit affects resources beyond the initially vulnerable renderer process. The CPE provided (cpe:2.3:a:google:chrome) identifies the Chrome codebase generically but does not itself distinguish the Android WebView build, which is the surface the description names.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome / Android WebView to 151.0.7922.72 or later, which for WebView on Android is delivered through Google Play system/component updates, so ensure devices receive Play Store updates to the Android System WebView and Chrome apps. Consult the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and the Chromium issue (https://issues.chromium.org/issues/498877660) to confirm the exact build for your platform. Because exploitation requires the user to load attacker-controlled content, interim compensating controls include restricting WebView-based apps from loading untrusted external URLs (enforce allowlists in embedding apps), and for managed fleets pushing the WebView/Chrome update via MDM to force compliance; user-awareness against opening untrusted links reduces the UI:R exposure but is not a substitute for patching.