What is the CVSS score of CVE-2026-17866?

CVE-2026-17866 has a contested CVSS base score of 5.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-17866?

Yes, a patch is available for CVE-2026-17866. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-17866

EUVD-2026-50615 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-xqvm-prp8-cc3x

Information Disclosure Google Memory Corruption

Medium

Disputed · 5.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.8 MEDIUM

Renderer pre-compromise captured by AC:H; unauthenticated network delivery via crafted page; scope change confirmed by sandbox escape; limited C/I/A reflects constrained post-escape impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:33 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

5.8 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 5.8

DescriptionCVE.org

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.

Technical ContextAI

CWE-843 (Type Confusion) occurs when code accesses a memory object as an incompatible type, producing undefined behavior and potential memory corruption. In Chrome's multi-process architecture, the renderer process is sandboxed from the OS and other Chrome processes - type confusion in the Tab component can corrupt internal state in a way that violates sandbox boundaries, allowing attacker-controlled code to escape to a more privileged execution context. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with Android as the target platform, specifically all Chrome versions below 151.0.7922.72. The CVSS S:C (Scope Changed) flag confirms that successful exploitation crosses security boundaries beyond the initially vulnerable component.

RemediationAI

Update Google Chrome for Android to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. Users should ensure auto-update is enabled or manually update via the Google Play Store. The official release advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the upstream Chromium issue is tracked at https://issues.chromium.org/issues/520525732. As a compensating control where immediate patching is not possible, restricting navigation to untrusted or user-supplied URLs reduces exposure to the crafted HTML delivery vector, though this does not address the underlying flaw. Enterprise deployments using Chrome management policies can enforce minimum version requirements via Chrome Browser Cloud Management.