What is the CVSS score of CVE-2026-17758?

CVE-2026-17758 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17758?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the WebGPU implementation; no public exploit identified at time of analysis, though successful…. A patch is available.

How to fix or mitigate CVE-2026-17758?

Within 24 hours, communicate the advisory to IT and affected teams, and create an inventory of Chrome deployments to identify systems running versions prior to 151.0.7922.72. Within 7 days, push patches to systems with the highest user risk exposure (those accessing untrusted content). Complete deployment of Chrome 151.0.7922.72 or later across the entire organization within 30 days.

Google Chrome CVE-2026-17758

EUVD-2026-50678 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-30 Chrome

GHSA-ffm3-9wph-xpfx

Buffer Overflow Google Heap Overflow

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page needs only user visit (PR:N/UI:R), but reliable heap-overflow sandbox escape requires exploit sophistication so AC:H; scope changes (S:C) on escape with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:25 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing web pages GPU compute and rendering access that runs in Chrome's GPU process. The root cause is CWE-122, a heap-based buffer overflow: attacker-controlled WebGPU calls from JavaScript reach native Dawn code where insufficient bounds checking on a heap allocation permits an out-of-bounds write. Because WebGPU is exposed to untrusted web content and Dawn code executes with GPU-process privileges (a less-restricted context than the renderer), a memory-corruption bug here is a plausible sandbox-escape primitive rather than a mere renderer crash. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, which contains the Dawn fix; verify via chrome://settings/help and relaunch to complete the update, as Chrome staged rollouts can delay automatic delivery. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html . If patching cannot be completed immediately, a specific compensating control is to disable WebGPU/Dawn by setting the chrome://flags/#enable-unsafe-webgpu flag to Disabled or deploying the WebGPU enterprise policy to off, which removes the vulnerable attack surface at the cost of breaking WebGPU-dependent sites and GPU-accelerated web apps; reducing exposure to untrusted sites and enforcing prompt auto-update via enterprise policy are additional interim measures. Users of Chromium-based browsers should apply their vendor's build incorporating the same Dawn fix.