What is the CVSS score of CVE-2026-17774?

CVE-2026-17774 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17774?

Chrome's Variations component (server-driven feature system) is vulnerable to heap corruption when network attackers intercept and corrupt its configuration traffic at startup.. A patch is available.

How to fix or mitigate CVE-2026-17774?

Within 24 hours, security teams should identify the scope of Chrome deployments across the organization (corporate-managed devices, BYOD population, etc.) and assess exposure to network-interception scenarios (guest WiFi, unencrypted networks, VPN concentrators). Within 7 days, deploy Chrome version 151.0.7922.72 or later via your enterprise update mechanism (Microsoft Intune, Google Admin Console, macOS managed updates, Linux repositories), prioritizing systems on high-risk networks. Within 30 days, verify deployment completion through your device management dashboard and confirm no Chrome instances remain on versions before 151.0.7922.72.

Google Chrome CVE-2026-17774

EUVD-2026-50723 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5r9f-54v2-c4hq

Information Disclosure Google

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Adjacent MITM position (AV:A) and high complexity to win the heap-corruption race (AC:H); crash/DoS is reliable (A:H) but code-exec confidentiality/integrity impact is only potential (C:L/I:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:25 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's Variations component before 151.0.7922.72 lets an attacker holding a privileged network position (an on-path / man-in-the-middle attacker) corrupt memory by delivering malicious network traffic, stemming from CWE-20 insufficient input validation. Google rates the Chromium severity as Medium and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. Because Variations (Chrome's server-driven feature-flag/experiment system) is fetched at startup in the browser process, a successful attacker could turn intercepted config traffic into a memory-safety primitive.

Technical ContextAI

The affected component is Chrome Variations, the mechanism Chromium uses to roll out feature experiments and field trials by fetching an encoded seed from Google servers over the network. The root cause is CWE-20 (Improper Input Validation): the Variations code insufficiently validates untrusted network data, producing heap corruption when a malformed payload is parsed. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions prior to 151.0.7922.72). Heap corruption during Variations parsing is notable because it occurs in the higher-privileged browser process rather than a sandboxed renderer, though escalation to full code execution is described by the vendor only as 'potentially' and is not confirmed.

RemediationAI

Update Google Chrome to 151.0.7922.72 or later via the Stable channel - this is a vendor-released patch (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); in managed fleets confirm auto-update is enabled and force a relaunch so the new browser-process build loads. As a compensating control until patching completes, ensure clients reach Google's Variations/update endpoints only over trusted TLS paths and deny adversary-in-the-middle positions on untrusted networks (enforce VPN on public Wi-Fi, avoid TLS-intercepting proxies for these domains); enterprises can also set the 'ChromeVariations' policy to 'VariationsDisabled', with the trade-off that Google can no longer remotely toggle features or push experiment-based mitigations. The advisory lists no additional workarounds, so upgrading is the primary fix.