What is the CVSS score of CVE-2026-17804?

CVE-2026-17804 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17804?

Google Chrome desktop versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17804) affecting millions of enterprise and consumer users.. A patch is available.

How to fix or mitigate CVE-2026-17804?

Within 24 hours, enumerate Chrome versions deployed across your organization using endpoint management tools and identify systems running versions prior to 151.0.7922.72. Within 7 days, push Chrome 151.0.7922.72 or later to all endpoints via your software distribution platform, prioritizing systems handling high-sensitivity data or possessing administrative privileges. Within 30 days, validate 100% patch deployment completion through vulnerability scanning, retire or isolate any systems that cannot be patched, and update your asset baseline to reflect the new minimum Chrome version requirement.

Google Chrome CVE-2026-17804

EUVD-2026-50753 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-gc2c-6hrc-5rpp

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and reliable UAF grooming plus user interaction (AC:H, UI:R); sandbox escape crosses the security boundary (S:C) with high host impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:22 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Media subsystem, which handles audio/video decoding, playback pipelines, and related MediaStream/WebCodecs functionality within the Chromium multi-process architecture. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, letting an attacker who controls heap contents corrupt object state and hijack control flow. Because Media code interacts with the renderer/browser process boundary, a UAF here can be leveraged to cross Chromium's sandbox - the security boundary that confines an exploited renderer. The affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build).

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - update Chrome to 151.0.7922.72 or later on all desktop platforms via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html), then fully restart the browser so the new build loads. Because updates roll out gradually, administrators should force the update through enterprise policy rather than waiting for automatic rollout, and verify the version in chrome://settings/help. If immediate patching is not possible, reduce exposure by restricting untrusted web browsing and enabling stricter site isolation and sandbox policies; note this does not close the underlying UAF and only limits the likelihood of chaining a renderer compromise. Users of Chromium-based browsers should apply the equivalent vendor build once available. The Chromium issue tracker reference (https://issues.chromium.org/issues/515448947) is access-restricted, as is typical for embargoed browser bugs.