What is the CVSS score of CVE-2026-17768?

CVE-2026-17768 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17768?

Google Chrome contains a critical sandbox escape flaw affecting versions prior to 151.0.7922.72 that could allow attackers to elevate privileges from compromised browser processes to full…. A patch is available.

How to fix or mitigate CVE-2026-17768?

Within 24 hours, issue an urgent notification to all Chrome users and restrict non-emergency Chrome usage pending updates; confirm your organization's patch deployment tooling is configured to push Chrome 151.0.7922.72 or later. Within 7 days, achieve 100% deployment of Chrome 151.0.7922.72 or later across all managed Windows, macOS, and Linux systems; coordinate with any teams managing Chromebook or ChromeOS devices to ensure equivalent version coverage. Within 30 days, audit all Chrome installations via your MDM or endpoint management platform to verify patch compliance and document remediation of any systems still running pre-151.0.7922.72 builds.

Google Chrome CVE-2026-17768

EUVD-2026-50717 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-xgpf-25jc-xvgf

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a pre-existing renderer compromise (PR:H) and chaining plus victim navigation (AC:H, UI:R); successful escape crosses the sandbox (S:C) with full code-execution impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 22:22 vuln.today

CVSS changed

Jul 31, 2026 - 22:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox via insufficient input validation in the WebSockets implementation, triggered by a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access bug: it requires a pre-existing renderer compromise plus user navigation to attacker content. No public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and it is not on CISA KEV, though Google has shipped a fixed Stable channel build.

Technical ContextAI

The flaw lives in Chromium's WebSocket handling, the browser-side plumbing that brokers the RFC 6455 WebSocket protocol between sandboxed renderer processes and the privileged browser (network/broker) process. The root cause is classified as CWE-20 (Improper Input Validation): data flowing from the untrusted renderer into the more-privileged process is not sufficiently validated, so a malicious renderer can supply crafted WebSocket-related input to corrupt state across the sandbox boundary. The single affected CPE is cpe:2.3:a:google:chrome (all versions below the fixed build), i.e. the desktop Chrome browser on the Stable channel; the same Chromium code is inherited by other Chromium-based browsers, though only Google Chrome is enumerated here.

RemediationAI

Vendor-released patch: update to Google Chrome 151.0.7922.72 or later on the Stable channel for desktop, per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html - restart the browser to apply the staged update, and in managed fleets push the pinned version and force a relaunch so the running process actually adopts the fix. Because exploitation requires a prior renderer compromise, meaningful compensating controls target that first stage: enforce Chrome's site isolation (default), keep the OS sandbox intact, and deploy enterprise policies to reduce renderer-compromise exposure (e.g. block or sandbox untrusted plugins/extensions, enable Enhanced Safe Browsing). There is no supported way to disable the WebSocket subsystem without breaking large numbers of web applications, so the practical mitigation is prompt upgrade rather than feature disablement; users of other Chromium-based browsers should apply their vendor's build that rebases onto the fixed Chromium version.