What is the CVSS score of CVE-2026-17856?

CVE-2026-17856 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17856?

Google Chrome on macOS contains a critical vulnerability that could result in complete system compromise.. A patch is available.

How to fix or mitigate CVE-2026-17856?

Within 24 hours, conduct an audit of Chrome deployments on macOS systems to establish baseline and identify update scope across the organization. Within 7 days, begin staged deployment of Chrome version 151.0.7922.72 through your update mechanisms or endpoint management platform, prioritizing high-risk user groups and business-critical systems. Within 30 days, complete validation that all macOS Chrome instances have been updated to 151.0.7922.72 or later, using endpoint telemetry to confirm coverage.

Google Chrome CVE-2026-17856

EUVD-2026-50605 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-rw7f-3qv6-gp4q

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because a prior renderer compromise must be chained; UI:R for visiting the page; S:C and high C/I/A reflect escaping the sandbox into the more-privileged host context.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:25 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on macOS before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a contained renderer exploit into broader access on the host. The flaw stems from an inappropriate implementation in Chrome's Network component and is fixed in the stable channel update. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Chromium rated the underlying severity Medium despite the NVD-style CVSS 9.6.

Technical ContextAI

The affected component is Chrome's multi-process security architecture on macOS, specifically the boundary between the sandboxed renderer process and the more-privileged browser/network layer. Chrome isolates web content in a locked-down renderer; a sandbox escape defeats that containment. The CWE-693 (Protection Mechanism Failure) classification indicates the sandbox protection mechanism itself was bypassable due to an 'inappropriate implementation in Network' rather than a classic memory-safety bug. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome generically, but the description narrows the defect to the macOS build prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72 for macOS. Update Chrome to 151.0.7922.72 or later via the built-in updater (chrome://settings/help) and relaunch the browser to apply; in managed fleets, push the update through MDM/enterprise policy and force a restart since Chrome will not complete the update until relaunched. Reference the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue at https://issues.chromium.org/issues/519991751. Because this is a sandbox escape that requires a prior renderer compromise, defense-in-depth against the initial foothold also helps: keep all Chrome components current, and where feasible enforce Site Isolation and restrict untrusted browsing, though these do not substitute for the patch.