What is the CVSS score of CVE-2026-17836?

CVE-2026-17836 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17836?

Google Chrome users in your organization face a remote code execution risk from CVE-2026-17836 when visiting crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-17836?

Within 24 hours: Communicate Chrome version requirements (151.0.7922.72 or later) to end users and device management teams. Within 7 days: Deploy Chrome 151.0.7922.72 or later to all managed endpoints and corporate desktops using your standard patch management process; verify deployment across at least 80% of user devices. Within 30 days: Complete full rollout to 100% of endpoints and validate through asset inventory; update security policies to enforce minimum Chrome version 151.0.7922.72 for all organization-managed devices.

Google Chrome CVE-2026-17836

EUVD-2026-50585 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-cgpw-34vx-hvv3

Google Use After Free RCE Denial Of Service Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable via a crafted page needing only a visit (UI:R, PR:N, AC:L); scope unchanged because execution stays within the sandbox, with high C/I/A on the renderer process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:27 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted web page

Delivery

Deliver malicious V8 JavaScript payload

Exploit

Trigger use-after-free in V8 heap

Execution

Hijack control flow via dangling pointer

Impact

Execute arbitrary code within renderer sandbox

Access

Lure victim to crafted web page

Delivery

Deliver malicious V8 JavaScript payload

Exploit

Trigger use-after-free in V8 heap

Execution

Hijack control flow via dangling pointer

Impact

Execute arbitrary code within renderer sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open an attacker-controlled or compromised HTML page with malicious JavaScript in a vulnerable Chrome build (<151.0.7922.72) - the UI:R metric confirms user interaction is mandatory, so no fully unattended/wormable exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects network reachability, low complexity, no privileges, but required user interaction (visiting a page) and, critically, an unchanged scope - the description explicitly states code execution occurs 'inside a sandbox,' so the raw impact overstates real-world severity until paired with a sandbox-escape bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts or compromises a web page containing crafted JavaScript that triggers the V8 use-after-free, then lures a victim to visit it (phishing link, malvertising, or a watering-hole site). When the page's script runs, the dangling pointer is exploited to execute arbitrary code within the browser's renderer sandbox. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staging leaves the old binary running until relaunch. … Detailed patch versions, workarounds, and compensating controls in full report.