What is the CVSS score of CVE-2026-17847?

CVE-2026-17847 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17847?

Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-17847, CVSS 9.6) that allows remote attackers to breach the browser's core containment model through malicious webpages,…. A patch is available.

How to fix or mitigate CVE-2026-17847?

Within 24 hours: Issue an urgent security bulletin to all staff warning against visiting untrusted websites and verify your organization's Chrome version distribution through endpoint management tools. Within 7 days: Mandate deployment of Chrome 151.0.7922.72 or later to all managed devices via your update management platform (e.g., Windows Update, Apple Business Manager, or Linux package managers), prioritizing teams with elevated security risk profiles. Within 30 days: Complete rollout verification, audit remaining vulnerable instances, and conduct incident response tabletop exercises to prepare for potential exploitation attempts that may have occurred during the vulnerability window.

Google Chrome CVE-2026-17847

EUVD-2026-50596 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-jgwr-xg86-4cxr

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N) but needs user visit (UI:R) and, per vendor 'Medium'/'potentially', likely chaining and specific conditions (AC:H); sandbox escape yields scope change with high host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:24 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, undermining the browser's core containment boundary. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE, Chrome's WebGL/OpenGL-to-native translation layer. It was reported internally by the Chrome team; there is no public exploit identified at time of analysis, and the EPSS score is low at 0.18% (8th percentile).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's abstraction library that translates OpenGL ES / WebGL API calls issued by web content into the platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced graphics commands from within the GPU/renderer process, a validation defect here is security-sensitive. The root cause is classified as CWE-20 (Improper Input Validation): untrusted data from a crafted page is not adequately checked before use in ANGLE, which - per the CVSS scope-change (S:C) metric - can let malicious content cross the process/sandbox boundary that normally isolates renderer code from the host. The single affected CPE is cpe:2.3:a:google:chrome (all versions below the fixed 151.0.7922.72 stable release).

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop stable channel (Windows, macOS, Linux); Chrome typically applies this automatically, so ensure auto-update is enabled and restart the browser to complete installation, verifying via chrome://settings/help. Users of Chromium-based browsers should install the equivalent updated build from their respective vendors once available. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and the Chromium issue tracker (https://issues.chromium.org/issues/518243653). If patching must be delayed, compensating controls include restricting exposure to untrusted web content and, for managed fleets, disabling hardware-accelerated graphics/WebGL via enterprise policy (e.g., the HardwareAccelerationModeEnabled policy) to reduce ANGLE's attack surface - with the trade-off that this degrades graphics performance and can break WebGL-dependent sites and applications.