What is the CVSS score of CVE-2026-17803?

CVE-2026-17803 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-17803?

Within 24 hours, inventory all Chrome deployments across the organization and verify current versions; notify security teams and users that a critical patch is available. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all end-user devices through your standard patch management process, prioritizing systems in high-trust environments or at elevated compromise risk. Within 30 days, complete organization-wide deployment verification, confirm patch adoption rates above 95%, and review security logs for any signs of renderer process exploitation attempts in the period before patching.

Google Chrome CVE-2026-17803

Q: Which versions of Google Chrome are affected by CVE-2026-17803?

A sandbox escape vulnerability in Google Chrome's "Save to Drive" feature (CVE-2026-17803, CVSS 9.6) could allow attackers who have already compromised the browser's renderer process to escape the…. A patch is available.

EUVD-2026-50752 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5phx-8r8q-59g9

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Compromise Chrome renderer process
Delivery

Deliver crafted PDF to Save to Drive
Exploit

Exploit improper input validation (CWE-20)
Execution

Cross sandbox boundary (scope change)
Impact

Execute code in higher-privileged browser process

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is an explicit prerequisite stated in the CVE, making the bug a second-stage sandbox escape rather than an initial-access flaw. The specific feature required is Chrome's "Save to Drive" functionality, and the trigger is a crafted PDF file processed through it; user interaction is also required (CVSS UI:R). Limiting factors: only Chrome versions before 151.0.7922.72 are vulnerable, the attacker must chain this with a separate renderer-compromise primitive, and user interaction plus use of the Save-to-Drive/PDF path are needed - so despite the AV:N/PR:N metrics, it cannot be exploited against a default browser without first defeating the renderer sandbox.
Impact	Signals conflict and must be read together. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), which looks critical, but Chromium's own severity rating is Medium and the description explicitly states the attacker must have ALREADY compromised the renderer process - a substantial precondition the PR:N/AC:L metrics do not capture. EPSS is low (0.19%, 9th percentile), there is no KEV listing and no public POC, all consistent with a difficult, chained exploitation path rather than a widely-weaponized bug. This is a real defense-in-depth issue (sandbox escapes are valuable as the second link in an exploit chain), but it is NOT a standalone remote-code-execution priority: it cannot be triggered without first defeating the renderer. Discrepancy to verify: CVSS advertises PR:N/AC:L network exploitation, yet the description requires a pre-compromised renderer, so real-world attack complexity is higher than the vector implies.
Exploit ScenarioDerived	An attacker first compromises a Chrome renderer process (for example via a separate renderer RCE bug delivered through a malicious web page), then uses that foothold to feed a specially crafted PDF into the "Save to Drive" flow. The malformed PDF exploits the input-validation gap to influence the higher-privileged browser process, escaping the sandbox and gaining code execution outside the renderer boundary. No public exploit is identified at time of analysis, and success depends on the user interaction and prior renderer compromise the CVSS vector (UI:R) and description require.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 31, 2026

Sandbox escape in Google Chrome's "Save to Drive" feature (prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by supplying a crafted PDF file. The flaw stems from insufficient validation of untrusted input (CWE-20) and, while scored CVSS 9.6, is rated only Medium by Chromium because it is a second-stage bug requiring a prior renderer compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a chained, non-trivial exploitation path rather than mass exploitation.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on all desktop platforms via the Stable channel and restart the browser to apply the fix (per the Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, force the update through enterprise policy and verify the deployed version fleet-wide. Because exploitation requires a pre-compromised renderer, interim risk is reduced by anything that hardens the renderer surface: enabling/enforcing Site Isolation and the Chrome sandbox (do not launch with --no-sandbox), keeping Chrome auto-update enabled, and restricting exposure to untrusted sites and documents; note that disabling PDF handling or the Save-to-Drive integration would blunt this specific vector but degrades expected browser functionality and is generally unnecessary once the patch is applied.

Affected VersionsENISA

Chrome 151.0.7922.72 <151.0.7922.72

Affected Packages

euvd chrome fix: 151.0.7922.72

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The issue lives in Chrome's "Save to Drive" pathway, which handles PDF documents and integrates browser-side logic with Google Drive upload/rendering. The root cause is CWE-20 (Improper Input Validation): untrusted data embedded in a crafted PDF is not sufficiently validated before being processed by a more-privileged browser component, allowing a compromised renderer to influence higher-privileged execution and cross the sandbox boundary (CVSS scope-change S:C). The affected component is the Chromium/Chrome desktop browser (CPE cpe:2.3:a:google:chrome), the same multi-process, sandboxed architecture in which the renderer is intentionally low-privilege and the browser process is the security boundary an attacker seeks to escape.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY 9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI 8.3 HIGH

AC:H because a prior renderer compromise and crafted-PDF chain are required; UI:R for the Save-to-Drive interaction; S:C and C/I/A:H reflect a full sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE CRITICAL

Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Medium)

Executive ViewAI

Why It Matters

A sandbox escape vulnerability in Google Chrome's "Save to Drive" feature (CVE-2026-17803, CVSS 9.6) could allow attackers who have already compromised the browser's renderer process to escape the sandbox and potentially gain full system access. While the technical severity is critical, real-world risk remains constrained by the low EPSS score (0.2%) and the requirement for a prior renderer compromise, indicating this is a chained attack rather than an immediate mass-exploitation risk. Organizations should prioritize patching within standard update cycles while monitoring for related renderer exploits.

Business Impact: High

Compensating Controls

Apply vendor patch (Chrome 151.0.7922.72 or later). Interim mitigations while deployment is ongoing: restrict untrusted PDF file handling in Chrome, enforce additional OS-level sandboxing controls if available, and monitor for suspicious renderer process activity or crashes that may indicate exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

Ubiquitous

Chrome is among the most widely deployed browsers in production worldwide

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +48

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.