What is the CVSS score of CVE-2026-17803?

CVE-2026-17803 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17803?

A sandbox escape vulnerability in Google Chrome's "Save to Drive" feature (CVE-2026-17803, CVSS 9.6) could allow attackers who have already compromised the browser's renderer process to escape the…. A patch is available.

How to fix or mitigate CVE-2026-17803?

Within 24 hours, inventory all Chrome deployments across the organization and verify current versions; notify security teams and users that a critical patch is available. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all end-user devices through your standard patch management process, prioritizing systems in high-trust environments or at elevated compromise risk. Within 30 days, complete organization-wide deployment verification, confirm patch adoption rates above 95%, and review security logs for any signs of renderer process exploitation attempts in the period before patching.

Google Chrome CVE-2026-17803

EUVD-2026-50752 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5phx-8r8q-59g9

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because a prior renderer compromise and crafted-PDF chain are required; UI:R for the Save-to-Drive interaction; S:C and C/I/A:H reflect a full sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:23 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's "Save to Drive" feature (prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by supplying a crafted PDF file. The flaw stems from insufficient validation of untrusted input (CWE-20) and, while scored CVSS 9.6, is rated only Medium by Chromium because it is a second-stage bug requiring a prior renderer compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a chained, non-trivial exploitation path rather than mass exploitation.

Technical ContextAI

The issue lives in Chrome's "Save to Drive" pathway, which handles PDF documents and integrates browser-side logic with Google Drive upload/rendering. The root cause is CWE-20 (Improper Input Validation): untrusted data embedded in a crafted PDF is not sufficiently validated before being processed by a more-privileged browser component, allowing a compromised renderer to influence higher-privileged execution and cross the sandbox boundary (CVSS scope-change S:C). The affected component is the Chromium/Chrome desktop browser (CPE cpe:2.3:a:google:chrome), the same multi-process, sandboxed architecture in which the renderer is intentionally low-privilege and the browser process is the security boundary an attacker seeks to escape.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on all desktop platforms via the Stable channel and restart the browser to apply the fix (per the Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, force the update through enterprise policy and verify the deployed version fleet-wide. Because exploitation requires a pre-compromised renderer, interim risk is reduced by anything that hardens the renderer surface: enabling/enforcing Site Isolation and the Chrome sandbox (do not launch with --no-sandbox), keeping Chrome auto-update enabled, and restricting exposure to untrusted sites and documents; note that disabling PDF handling or the Save-to-Drive integration would blunt this specific vector but degrades expected browser functionality and is generally unnecessary once the patch is applied.