What is the CVSS score of CVE-2026-17752?

CVE-2026-17752 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17752?

A critical execution flaw in Chrome for Mac poses a direct risk to employee data and system security, affecting all users with versions before 151.0.7922.72.. A patch is available.

How to fix or mitigate CVE-2026-17752?

Within 24 hours, deploy Chrome version 151.0.7922.72 or later to all Mac endpoints using your organization's patch management or MDM system and verify auto-update is enabled. Within 7 days, confirm patch deployment across all Mac devices through device inventory or endpoint security scanning tools, prioritizing any non-compliant systems. Within 30 days, establish a standardized browser patch cycle (quarterly minimum) covering Chrome and other Chromium-based browsers (Edge, Brave, Chromium) and document the SLA in your security policies.

Google Chrome CVE-2026-17752

EUVD-2026-50702 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-fr89-v3cf-ch5c

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N/AC:L) needs no auth (PR:N) but requires the user to open it (UI:R); a UAF enabling code execution yields high C/I/A within the browser process (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:25 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chrome's 'Views' subsystem - the cross-platform UI framework Chromium uses to render browser chrome and widgets (windows, menus, dialogs) on the desktop. A use-after-free occurs when a pointer to freed heap memory is dereferenced, letting an attacker reclaim the freed allocation with attacker-controlled data and corrupt the heap; in a browser this can be steered toward control-flow hijacking. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome application, and the description specifically scopes the issue to the macOS build reached via a crafted HTML page processed by the browser.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Chrome Releases Stable Channel Update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome normally auto-updates, so ensure the browser is fully closed and relaunched to apply the update, then verify via chrome://settings/help. In managed fleets, push the pinned version through your MDM/enterprise update policy to force compliance. Until updating is confirmed, reduce exposure by advising users to avoid untrusted links and, if your environment supports it, enable Chrome's Enhanced Safe Browsing to add heuristic blocking of malicious pages; note this does not eliminate the underlying flaw and only reduces the odds of encountering a weaponized page. No effective feature-level workaround is documented for a UAF in the Views component, so patching is the authoritative fix.