What is the CVSS score of CVE-2026-17801?

CVE-2026-17801 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17801?

Google Chrome users across your organization face potential system compromise through a critical sandbox escape flaw in the graphics layer, which could allow attackers to execute code via malicious…. A patch is available.

How to fix or mitigate CVE-2026-17801?

Within 24 hours, inventory all Chrome deployments to identify versions prior to 151.0.7922.72 and prepare patch distribution through your standard update mechanisms (Chrome auto-update, enterprise policy, or manual deployment). Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected endpoints and validate the update was successful. Within 30 days, confirm that 100% of Chrome installations have been updated to a patched version and conduct any necessary post-patch testing.

Google Chrome CVE-2026-17801

EUVD-2026-50750 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-mqwp-x4h4-hcg4

Buffer Overflow Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via a crafted page needing user interaction; AC:H because a memory-corruption sandbox escape via ANGLE requires non-trivial heap grooming, and S:C reflects breaking out of the renderer sandbox.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:23 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction library that translates OpenGL ES / WebGL API calls into the platform's native GPU backend (Direct3D, Metal, Vulkan, or desktop GL). Because it processes untrusted WebGL/graphics commands originating from web content, ANGLE runs at a security-sensitive boundary between the sandboxed renderer and the GPU process. The root cause is CWE-125 class memory safety failure - an out-of-bounds read combined with an out-of-bounds write, indicating missing or incorrect bounds validation when parsing or executing crafted graphics commands. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all builds before 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel, then fully restart the browser to load the new build (Chrome auto-updates but requires a relaunch to apply). The fix is documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because the vulnerable code is in ANGLE/WebGL, an interim compensating control for high-risk fleets is to disable hardware acceleration or block WebGL (e.g., via enterprise policy 'HardwareAccelerationModeEnabled=false' or by disabling WebGL), which reduces the ANGLE attack surface but degrades graphics performance and breaks WebGL-dependent sites. Enforce managed auto-update policies so endpoints reach 151.0.7922.72 promptly, and verify Chromium-based browsers (Edge, Brave, Opera) are updated to their equivalent patched releases.