What is the CVSS score of CVE-2026-17816?

CVE-2026-17816 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17816?

Google Chrome on Android before version 151.0.7922.72 contains a privilege escalation vulnerability that amplifies the impact of browser compromises by allowing attackers deeper access to affected…. A patch is available.

How to fix or mitigate CVE-2026-17816?

Within 24 hours, assess the scope of Chrome on Android deployments across your organization and communicate the vulnerability to affected user groups. Within 7 days, deploy Google Chrome 151.0.7922.72 or later to all Android devices through mobile device management (MDM) systems or by enabling automatic updates, with priority given to devices with administrative access. Within 30 days, verify that 100% of Android Chrome installations are running patched versions, review system logs for any suspicious renderer process activity, and conduct user awareness training on browser security practices.

Google Chrome CVE-2026-17816

EUVD-2026-50765 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-frx2-g4p6-x329

Privilege Escalation Google

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Requires a pre-compromised renderer (foothold), so PR:L not PR:N; AC:H and UI:R for the chained crafted-page step; full C/I/A impact from sandbox privilege escalation.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:26 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome on Android before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process escape further via insufficient policy enforcement in the Speech component and a crafted HTML page. Rated Medium by Chromium but scored CVSS 7.5, it enables a second-stage sandbox/privilege boundary bypass rather than initial access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's Speech subsystem (Web Speech API / speech recognition and synthesis handling) on the Android platform. CWE-269 (Improper Privilege Management) indicates the component fails to correctly enforce policy boundaries between the sandboxed renderer and higher-privileged browser components, so a renderer that is already under attacker control can drive Speech functionality to gain privileges it should not have. The affected code is identified by cpe:2.3:a:google:chrome, but the description explicitly scopes impact to the Android build of Chrome, where the renderer sandbox and IPC surface differ from desktop.

RemediationAI

Vendor-released patch: update Google Chrome on Android to version 151.0.7922.72 or later, which is delivered through the Chrome Stable channel and Google Play; see the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, ensure the app is not blocked from updating and force-restart the browser after update to apply it. No standalone workaround is documented; as a compensating control until updated, avoid opening untrusted web pages and consider using enterprise policy to restrict Speech/Web Speech API usage where manageable, accepting that this degrades legitimate speech-input and text-to-speech functionality. Since exploitation requires a pre-compromised renderer, keeping the browser fully patched against renderer RCE bugs is the most effective layered mitigation.