What is the CVSS score of CVE-2026-17832?

CVE-2026-17832 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17832?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17832) that could enable full system compromise following an initial browser compromise.. A patch is available.

How to fix or mitigate CVE-2026-17832?

Within 24 hours, distribute a security advisory to all personnel regarding the Chrome vulnerability and generate an inventory of all systems running Chrome versions prior to 151.0.7922.72. Within 7 days, complete patching of all organizational Chrome installations to version 151.0.7922.72 or later through automated update mechanisms or centralized deployment tools. Within 30 days, review endpoint monitoring logs for indicators of browser renderer process compromise, document patch deployment completion for compliance records, and validate the vulnerability cannot be exploited on updated Chrome versions.

Google Chrome CVE-2026-17832

EUVD-2026-50581 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-r3xh-r9mw-vh95

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-existing renderer compromise plus winning a UAF race; UI:R for visiting crafted content; S:C and C/I/A:H reflect full sandbox escape to a higher-privilege process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:24 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform graphics abstraction that translates WebGL/OpenGL ES calls onto native backends (Direct3D, Metal, Vulkan, desktop GL). It runs across the renderer/GPU boundary and is a recurring source of memory-safety bugs because it processes attacker-influenced graphics command streams. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer lets an attacker corrupt memory. Because ANGLE straddles the sandbox boundary, corrupting its state from a compromised renderer can be leveraged to execute code in the more-privileged GPU/browser context. The affected component is the Chrome desktop browser (cpe:2.3:a:google:chrome), fixed in the 151.0.7922.72 stable channel build.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on managed fleets, force the update and relaunch since Chrome only applies pending updates on restart, and confirm rollout through chrome://settings/help. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, reduce exposure by restricting untrusted web browsing and, where acceptable, disabling hardware-accelerated graphics (chrome://settings, 'Use graphics acceleration when available', or the --disable-gpu flag) to limit reachability of the ANGLE code path - with the trade-off of degraded WebGL/rendering performance. Because exploitation also requires a prior renderer compromise, keeping site isolation enabled (default) and applying all concurrent renderer-RCE fixes in the same release meaningfully raises the bar. Chromium-based browsers should be updated to builds incorporating the equivalent ANGLE fix.