What is the CVSS score of CVE-2026-17806?

CVE-2026-17806 has a contested CVSS base score of 5.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17806?

Yes, a patch is available for CVE-2026-17806. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17806

EUVD-2026-50755 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-wjcp-qjjm-r7w3

Information Disclosure Google

Medium

Disputed · 5.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.8 MEDIUM

AC:H captures mandatory prior renderer compromise; S:C reflects sandbox boundary crossing; C/I/A:L because post-escape impact is limited and not full system compromise per available data.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:37 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

5.8 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.8

DescriptionCVE.org

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).

Technical ContextAI

Google Chrome implements a multi-process architecture in which the renderer process is sandboxed and isolated from the underlying operating system. The Extensions subsystem bridges the renderer and the browser process, handling untrusted input from web content and extension APIs. CWE-20 (Improper Input Validation) in this component means that the Extensions layer fails to adequately validate attacker-controlled data originating from a compromised renderer. Because the Extensions API can interact with elevated browser-process privileges and system resources, a validation failure here can allow the renderer sandbox to be escaped. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to 151.0.7922.72 on all supported platforms.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later immediately; this is a vendor-released patch confirmed via the Chrome stable channel blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism should deliver this to most endpoints automatically, but administrators managing enterprise fleets should verify deployment via policy. As a compensating control pending patch deployment, organizations can enforce Chrome enterprise policies to restrict extension permissions and disable untrusted or unreviewed extensions via the ExtensionSettings policy, which reduces the Extensions attack surface. Restricting Chrome use to managed profiles with allowlisted extensions limits exposure but does not eliminate it, since the flaw lies in input validation within the Extensions component itself. There are no known workarounds that fully mitigate the sandbox escape without patching.