What is the CVSS score of CVE-2026-17867?

CVE-2026-17867 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17867?

Google Chrome desktop environments face a critical vulnerability (CVE-2026-17867) that could enable attackers to break out of the browser sandbox and gain system-level access when users visit…. A patch is available.

How to fix or mitigate CVE-2026-17867?

Within 24 hours, conduct a Chrome version audit across all managed desktop endpoints to identify systems running versions prior to 151.0.7922.72 and assess user populations most exposed to untrusted web content. Within 7 days, initiate staged deployment of Chrome 151.0.7922.72 or later through your endpoint management platform, beginning with non-production systems and test groups to validate application compatibility before organization-wide rollout. Within 30 days, complete mandatory updates to Chrome 151.0.7922.72 or later across all desktop instances, with verification through endpoint telemetry and documented sign-off for any systems unable to patch.

Google Chrome CVE-2026-17867

EUVD-2026-50616 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-58ff-pxwr-4jq2

Information Disclosure Google

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.8 MEDIUM

Remote via crafted page (AV:N, PR:N) needing victim navigation (UI:R); AC:H because a reliable Dawn sandbox escape realistically requires winning conditions/chaining, with scope change (S:C) and Low CIA impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:32 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

7.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop Chrome builds prior to 151.0.7922.72, where insufficient validation of untrusted input lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity Medium and the issue carries a CVSS 7.1 with scope change, but there is no public exploit identified at time of analysis and EPSS is very low at 0.18% (8th percentile). Google has shipped a patched Stable channel release addressing it.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU API, providing web pages low-level access to the GPU for compute and rendering. Because WebGPU exposes a large, complex native surface (command validation, resource binding, shader inputs) to untrusted JavaScript running in the sandboxed renderer, flaws here are a recurring sandbox-escape vector. The root cause is classified as CWE-20 (Improper Input Validation): Dawn does not sufficiently validate untrusted parameters supplied by web content, which can be leveraged to cross the renderer/host trust boundary - reflected in the CVSS scope change (S:C). The affected component matches CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome's automatic updater will normally apply this, so verify via chrome://settings/help and relaunch to complete installation, and in managed fleets push the update through your management channel and confirm rollout. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, the exploitation prerequisite of WebGPU means a compensating control is to disable WebGPU/Dawn by launching Chrome with --disable-features=WebGPU or via the corresponding enterprise policy, which blocks the affected code path at the cost of breaking legitimate WebGPU-based sites and applications; user-awareness measures to avoid untrusted links reduce but do not eliminate exposure since only a page visit is required.