What is the CVSS score of CVE-2026-17848?

CVE-2026-17848 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17848?

Google Chrome desktop contains a sandbox escape vulnerability (CVE-2026-17848) in media codec handling affecting versions prior to 151.0.7922.72 that could enable remote code execution when users…. A patch is available.

How to fix or mitigate CVE-2026-17848?

Within 24 hours, audit all Chrome desktop installations across your environment to identify systems running versions prior to 151.0.7922.72 and establish patching timeline with IT operations. Within 7 days, deploy Chrome 151.0.7922.72 or later to 100% of desktop systems through your standard patch management process, prioritizing administrative and developer endpoints. Within 30 days, complete patch verification across all Chrome desktop instances, confirm auto-update is enabled organization-wide, and enable endpoint telemetry and web proxy logging to detect any exploitation attempts targeting this vulnerability.

Google Chrome CVE-2026-17848

EUVD-2026-50597 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-hfr7-894p-qm78

Buffer Overflow Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote and unauthenticated but requires the victim to load crafted media (UI:R) and reliable sandbox escape is nontrivial (AC:H); sandbox escape justifies scope change (S:C).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:24 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.

Technical ContextAI

The vulnerability lives in Chrome's Codecs component, the media pipeline responsible for demuxing and decoding video streams (e.g., H.264/VP9/AV1 containers). The root cause is classified as CWE-20 (Improper Input Validation): a specific length, dimension, or offset field in a crafted video file is not validated before arithmetic, producing an integer overflow that yields an undersized allocation or out-of-bounds index - the accompanying 'Buffer Overflow' tag reflects the memory-corruption consequence. Because media decoding can occur in a lower-privileged process, a corruption primitive here is leveraged toward a sandbox escape, moving code execution beyond the renderer's confinement. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application across versions below the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installs will receive this automatically, so verify auto-update is enabled and force a relaunch to apply it. In managed fleets, push the pinned version via enterprise policy and confirm the effective version in chrome://settings/help. As an interim compensating control before rollout, reduce exposure to untrusted media by discouraging users from opening video files or pages from unknown sources and by using content filtering/proxy controls to limit attacker-controlled media delivery - these lower the odds a user triggers the required interaction but do not fully close the flaw and can hinder legitimate media use, so they are stopgaps only until the update is deployed.