What is the CVSS score of CVE-2026-17865?

CVE-2026-17865 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17865?

Chrome for macOS versions prior to 151.0.7922.72 contain a critical sandbox escape (CVE-2026-17865) allowing renderer-compromised processes to escalate to full device control.. A patch is available.

How to fix or mitigate CVE-2026-17865?

Within 24 hours, scan macOS endpoints to identify Chrome installations below version 151.0.7922.72 and assess affected user count. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected macOS systems through your standard update mechanism, prioritizing administrative users and systems with sensitive data access. Within 30 days, confirm deployment completion across your macOS fleet and establish continuous version monitoring to prevent regression.

Google Chrome CVE-2026-17865

EUVD-2026-50614 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-w27c-274j-76rc

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N, UI:R) but requires chaining a prior renderer compromise, raising complexity to AC:H; sandbox escape crosses trust boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:26 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for macOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page, escalating a contained renderer foothold toward the host. The flaw sits in Chrome's Crypto component and is a second-stage bug that must be chained with an initial renderer compromise. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Google rates the Chromium security severity as Medium despite the high CVSS.

Technical ContextAI

The defect is classed under CWE-693 (Protection Mechanism Failure), meaning a security control - here the Chrome renderer sandbox that isolates untrusted web content from the browser and OS - is implemented in a way that can be bypassed rather than a memory-corruption primitive per se. The affected surface is Chrome's Crypto implementation on the macOS platform build (cpe:2.3:a:google:chrome:*). Chrome's multi-process architecture confines rendering of web pages to a low-privilege renderer; a sandbox escape like this abuses inappropriate implementation to cross that trust boundary from renderer into a higher-privilege context, which is why the CVSS scope is marked Changed (S:C).

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - update the macOS Stable channel to that build or later (Chrome menu > About Google Chrome forces the update check and applies the fix on relaunch). In managed fleets, push the update via MDM/Google Admin console and force a browser restart so the staged update takes effect, since the fix is inert until relaunch. There is no separate workaround for a sandbox-escape defect; the meaningful compensating control is to reduce renderer-compromise exposure that this bug chains from - keep Chrome fully updated so the initial renderer bug is closed, and consider enabling stricter site isolation and enterprise policies that limit untrusted content, accepting minor compatibility friction. Reference: Google Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and Chromium issue 520516655.