What is the CVSS score of CVE-2026-17862?

CVE-2026-17862 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17862?

Google Chrome for Windows versions prior to 151.0.7922.72 contain a local privilege escalation vulnerability that enables an attacker to gain OS-level system access if a user opens a malicious file.. A patch is available.

How to fix or mitigate CVE-2026-17862?

Within 24 hours: identify all Windows endpoints running Chrome and prioritize patching based on user role and data access. Within 7 days: deploy Google Chrome 151.0.7922.72 or later to all Windows systems, prioritizing administrative and privileged user accounts. Within 30 days: verify 100% deployment coverage via endpoint management tools and reinforce user security awareness training regarding opening untrusted files from external sources.

Google Chrome CVE-2026-17862

EUVD-2026-50611 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-776x-g92c-pvpp

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption Microsoft

High

Disputed · 7.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local malicious-file delivery gives AV:L; victim must open the file so UI:R; no privileges needed (PR:N); OS-level privilege escalation yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:27 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.8

DescriptionCVE.org

Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.

Technical ContextAI

The flaw lives in Chrome's Tracing subsystem, the instrumentation/telemetry framework (trace-event and Perfetto-based profiling) used for performance diagnostics within the browser. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains, and subsequent access to that freed memory allows an attacker to control freed heap contents and corrupt program state. Per the CPE data (cpe:2.3:a:google:chrome), the affected artifact is the Chrome application itself on Windows; the tags (Use After Free, Memory Corruption, Privilege Escalation) corroborate a heap memory-corruption primitive that, in this Windows-specific case, is leveraged to cross into OS-level privilege rather than remaining a browser-sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows; Chrome typically auto-updates, but administrators should force the update and relaunch the browser to apply it, verifying via chrome://settings/help and consulting the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires the victim to open a malicious file, interim compensating controls include restricting or blocking the delivery and opening of untrusted files (e.g., email attachment filtering and download restrictions) and enforcing least privilege so a successful exploit yields less on the host - though these do not remove the underlying use-after-free and add operational friction. Given a fix already exists, patching is the definitive remediation and should not be deferred in favor of workarounds.