What is the CVSS score of CVE-2026-17770?

CVE-2026-17770 has a contested CVSS base score of 5.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17770?

Yes, a patch is available for CVE-2026-17770. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17770

EUVD-2026-50719 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-jg6f-wwpp-jhgg

Buffer Overflow Information Disclosure Google

Medium

Disputed · 5.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.8 MEDIUM

AC:H reflects the mandatory renderer-compromise prerequisite; S:C captures sandbox escape; PR:N applies to the network delivery stage; C/I/A:L reflects partial impact post-escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:38 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

5.8 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.8

DescriptionCVE.org

Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.

Technical ContextAI

The vulnerability (CWE-125, Out-of-bounds Read) resides in Chrome's Media subsystem, which handles decoding and processing of audio/video content embedded in web pages. Chrome's multi-process security architecture isolates web content in a sandboxed renderer process; a sandbox escape crosses from this constrained environment to the host OS, represented by S:C in the CVSS vector. Affected product CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the platform constraint of macOS. The OOB read allows reading memory beyond an allocated buffer boundary, which in a sandbox-escape context is typically used to leak memory layout data enabling further exploitation of the broader OS environment.

RemediationAI

Vendor-released patch: 151.0.7922.72 for macOS. Update Google Chrome to version 151.0.7922.72 or later immediately on all macOS endpoints; Chrome's automatic update mechanism will apply this in most managed environments. The vendor advisory is at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control while patching is staged, ensure Chrome's built-in site isolation is active (verify via chrome://flags/#enable-site-per-process) to reduce renderer compromise risk that is a prerequisite for this vulnerability - disabling site isolation would increase exposure to the initial renderer stage. No specific workaround eliminates the OOB read itself without the patch.