What is the CVSS score of CVE-2026-17863?

CVE-2026-17863 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17863?

Google Chrome for Windows contains a local privilege escalation vulnerability (CVE-2026-17863) that allows attackers with local system access to gain administrative privileges.. A patch is available.

How to fix or mitigate CVE-2026-17863?

Within 24 hours: Identify all Windows systems running Chrome versions prior to 151.0.7922.72 and assess exposure of systems used by privileged users or those accessing sensitive data. Within 7 days: Deploy Google Chrome version 151.0.7922.72 or later across all Windows endpoints using your standard patch management workflow, prioritizing administrative and data-sensitive workstations first. Within 30 days: Complete deployment verification across all Windows systems and establish monitoring for any process-level exploitation attempts targeting Chrome on Windows.

Google Chrome CVE-2026-17863

EUVD-2026-50612 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-8hrm-cqg3-jpx9

Privilege Escalation Google Microsoft

High

Disputed · 7.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-based trigger (AV:L) needing the victim to open the file (UI:R); no prior privileges assumed (PR:N) and full local compromise gives high C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:27 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.8

DescriptionCVE.org

Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome on Windows prior to 151.0.7922.72 lets a local attacker gain elevated privileges through a malicious file that the victim opens or that Chrome processes, stemming from an inappropriate implementation in the Browser process. Google rates the Chromium security severity as Medium, while the NVD-style CVSS of 7.8 reflects high confidentiality, integrity, and availability impact once triggered. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor has shipped a fix.

Technical ContextAI

The affected component is the Browser process of Chromium-based Google Chrome on the Windows platform, per CPE cpe:2.3:a:google:chrome:*. The root cause is classified as CWE-269 (Improper Privilege Management), described as an 'inappropriate implementation in Browser' - meaning a browser-side operation performs a privileged action or trusts a file without adequately enforcing the privilege boundary. Because it is Windows-specific and triggered 'via a malicious file,' the flaw likely involves how the browser handles file paths, downloaded content, or on-disk resources with more trust than warranted, allowing an operation to run at a higher privilege than the local user should control. The Chromium bug is tracked at issues.chromium.org/issues/520468718.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Stable channel; restart the browser to complete the update so the patched binary is loaded (per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In enterprise fleets, push the update through your management tooling (e.g., group policy / Chrome Browser Cloud Management) and verify the version rather than relying on background auto-update, which may be delayed. Until patched, reduce exposure by restricting users' ability to open or execute untrusted files and by running Chrome under least-privilege user accounts so a successful escalation yields less; because the trigger is a malicious file requiring user interaction, user awareness and blocking untrusted downloads meaningfully lowers risk, though these controls do not fully substitute for the update.