What is the CVSS score of CVE-2026-17807?

CVE-2026-17807 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17807?

Google Chrome versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the V8 JavaScript engine allowing remote code execution within the renderer sandbox when users visit crafted…. A patch is available.

How to fix or mitigate CVE-2026-17807?

Within 24 hours, inventory Chrome deployments and communicate patch availability to stakeholders. Within 7 days, deploy Chrome 151.0.7922.72 or later to all organization-managed Chrome installations via MDM, Group Policy, or standard update mechanisms. Within 30 days, verify remediation through endpoint telemetry or vulnerability scanning and document 100% patch compliance.

Google Chrome CVE-2026-17807

EUVD-2026-50756 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-xfj2-r3x7-44mr

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth (AV:N/PR:N) but victim must open it (UI:R); code stays in renderer sandbox so Scope Unchanged with high C/I/A within the process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:27 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.

Technical ContextAI

The vulnerability resides in V8, the C++ JavaScript and WebAssembly engine that compiles and executes script in every Chromium-based browser. As a CWE-416 use-after-free, the root cause is a dangling pointer: V8 frees a heap object (likely during JavaScript execution or garbage collection) but later dereferences it, letting an attacker reclaim and control that memory to corrupt engine state and gain code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; because V8 is shared across all Chromium forks (Edge, Brave, Opera, Electron apps), the underlying defect class typically has downstream impact beyond Chrome itself, though only Chrome is enumerated here. Notably, the description states execution occurs 'inside a sandbox,' meaning V8 memory corruption is contained by Chrome's renderer sandbox and would still require a separate sandbox-escape bug to achieve full host compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel, then fully restart the browser to load the new binary (Chrome staged updates do not take effect until relaunch). Verify rollout centrally in managed fleets and confirm auto-update is not disabled by policy. If immediate patching is not possible, reduce exposure by restricting untrusted browsing, enabling Chrome's Enhanced Safe Browsing, and - for high-risk users - enabling the Site Isolation and strict sandbox protections that already contain V8 renderer bugs; note these are mitigations that reduce but do not eliminate risk. Users of other Chromium-based browsers should apply their vendor's corresponding V8 update. Advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html .