What is the CVSS score of CVE-2026-17834?

CVE-2026-17834 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17834?

Google Chrome desktop versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17834, CVSS 9.6) that enables privilege escalation from the renderer process to the…. A patch is available.

How to fix or mitigate CVE-2026-17834?

Within 24 hours, alert all system administrators and security teams of the critical vulnerability and coordinate testing of Chrome version 151.0.7922.72 in staging environments. Within 7 days, begin phased deployment of Chrome 151.0.7922.72 or later across all desktop systems, prioritizing developers, administrators, and staff who regularly access external websites. Within 30 days, complete organization-wide deployment and validate 100% compliance through endpoint management systems.

Google Chrome CVE-2026-17834

EUVD-2026-50583 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-85jh-mvhg-cjgw

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Kept AV:N/UI:R/S:C but raised to AC:H because a successful attack depends on first achieving a separate renderer compromise, a substantial precondition beyond a single request.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:24 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, chaining into the higher-privileged browser process. The flaw stems from insufficient validation of untrusted input in the Passwords component (CWE-20) and is rated Medium by Chromium despite an NVD CVSS of 9.6. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

Technical ContextAI

The vulnerability lives in Chrome's Passwords subsystem, a browser-process feature that manages saved credential storage and autofill. Chrome runs untrusted web content in low-privilege renderer processes isolated by a sandbox; privileged operations are brokered to the browser process via Mojo/IPC. CWE-20 (Improper Input Validation) here means the browser process trusts data crossing that IPC boundary from the renderer without adequately validating it, so a renderer that an attacker already controls can send malformed input that the more-privileged process mishandles, producing a sandbox escape. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all desktop builds before the fixed release.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel and restart the browser to apply it (Chrome auto-updates but requires a relaunch to complete); see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy and confirm the effective version, and ensure Chromium-derived browsers pull the corresponding upstream fix. Because exploitation requires a prior renderer compromise, enabling and enforcing Chrome's site isolation and keeping renderer-facing components current reduces chain feasibility; where immediate updating is impossible, restricting browsing to trusted sites and deploying strict extension/content controls lowers the odds of the first-stage renderer bug that this issue depends on, at the cost of user convenience.