What is the CVSS score of CVE-2026-17750?

CVE-2026-17750 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17750?

Google Chrome's ANGLE graphics component contains a sandbox escape vulnerability (CVE-2026-17750) affecting all desktop systems running versions prior to 151.0.7922.72, where remote attackers can…. A patch is available.

How to fix or mitigate CVE-2026-17750?

Within 24 hours, verify that Chrome 151.0.7922.72 or later is available in your browser deployment channel and test compatibility with critical line-of-business applications in a non-production environment. Within 7 days, push the patched version to all desktop systems (Windows, macOS, Linux) via SCCM, Jamf, or your MDM platform as a mandatory deployment. Within 30 days, confirm 100% deployment completion through endpoint telemetry, document the patched baseline in your vulnerability management system, and validate no systems remain below 151.0.7922.72 through asset inventory.

Google Chrome CVE-2026-17750

EUVD-2026-50700 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-xfq5-gfch-m94w

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Remote crafted page needs no auth (PR:N) but requires the victim to visit it (UI:R); sandbox-escape potential justifies S:C with partial (Low) C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls onto the host platform's native graphics APIs (Direct3D, Metal, Vulkan, OpenGL). Because WebGL content is driven directly by untrusted web pages, ANGLE processes attacker-influenced rendering commands inside the GPU/renderer process. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains reachable, and subsequent use of that stale pointer corrupts memory. In a browser context this memory corruption in ANGLE can be leveraged toward a sandbox escape, meaning code influence beyond the confines of the sandboxed renderer. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop application across versions below the fixed build.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72 - upgrade Chrome desktop to 151.0.7922.72 or later, then fully restart the browser to load the new build, as documented in the Chrome Stable Channel update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed fleets, ensure automatic updates are enabled and force a relaunch to guarantee the fix is applied, since Chrome only completes the update on restart. If patching must be delayed, the practical interim control is to disable hardware-accelerated graphics / WebGL exposure - for example turning off 'Use graphics acceleration when available' or restricting WebGL via enterprise policy - which reduces the untrusted attack surface into ANGLE at the cost of degraded rendering performance for graphics-heavy sites; combine with cautious browsing to avoid untrusted pages. Downstream Chromium-based browsers should be updated to the release that incorporates the equivalent ANGLE fix.