What is the CVSS score of CVE-2026-17784?

CVE-2026-17784 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17784?

A critical sandbox escape vulnerability in Google Chrome for macOS (CVE-2026-17784) poses a risk to organizational endpoints running versions prior to 151.0.7922.72.. A patch is available.

How to fix or mitigate CVE-2026-17784?

Within 24 hours: ensure all macOS endpoints running Chrome have automatic updates enabled and verify the browser is updated to version 151.0.7922.72 or later. Within 7 days: conduct a compliance audit across all managed endpoints to confirm no instances of Chrome remain on affected versions, and document update status in your asset inventory. Within 30 days: establish a monitoring baseline to track Chrome version distribution across macOS endpoints and configure alerts for any machines falling out of compliance with the minimum required version 151.0.7922.72.

Google Chrome CVE-2026-17784

EUVD-2026-50733 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-m6mj-vrrh-w93x

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H reflects mandatory prior renderer compromise; S:C reflects sandbox escape changing scope beyond the renderer to the host OS.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 22:24 vuln.today

CVSS changed

Jul 31, 2026 - 22:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.

Technical ContextAI

The vulnerability resides in the Audio subsystem of Chromium's renderer on macOS, classified as CWE-416 (Use After Free). A UAF occurs when memory is freed but a dangling pointer to that memory region is subsequently dereferenced, allowing an attacker to corrupt heap memory or redirect control flow. In the Chromium architecture, the renderer process runs within a sandbox that restricts access to OS resources; a UAF in the Audio component can be weaponized to corrupt renderer-internal state in a way that facilitates escaping this sandbox boundary. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions below 151.0.7922.72 on Mac. The Mac-specific scope suggests the vulnerability may involve macOS Audio APIs or platform-specific memory management paths in the Chromium audio stack.

RemediationAI

Update Google Chrome on macOS to version 151.0.7922.72 or later, which contains the vendor-released fix as announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify version currency via chrome://settings/help or fleet management tooling. Because exploitation requires a prior renderer compromise, organizations unable to immediately patch can partially reduce risk by enabling Chrome's Site Isolation feature (chrome://flags/#enable-site-per-process) and restricting access to untrusted web content through proxy filtering - however, neither fully mitigates this vulnerability and patching remains the only definitive remediation. The Chromium bug tracker issue https://issues.chromium.org/issues/513694032 may contain additional technical details once publicly disclosed.