What is the CVSS score of CVE-2026-17869?

CVE-2026-17869 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17869?

A high-severity memory corruption bug in Chrome's WebXR implementation (CVE-2026-17869) enables remote attackers to harvest sensitive data from the browser process or trigger application crashes by…. A patch is available.

How to fix or mitigate CVE-2026-17869?

Within 24 hours, audit Chrome deployment across your organization and test Chrome 151.0.7922.72 or later in a non-production environment to verify no compatibility issues with business-critical web applications. Within 7 days, schedule and begin phased deployment of Chrome 151.0.7922.72 or later across all endpoints, prioritizing users who regularly visit external or user-generated websites. Within 30 days, complete full organizational deployment and validate through automated compliance scanning to ensure no instances of vulnerable Chrome versions remain active.

Google Chrome CVE-2026-17869

EUVD-2026-50618 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-8qfc-8wf8-q4v5

Buffer Overflow Information Disclosure Google

High

Disputed · 8.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

vuln.today AI

8.1 HIGH

Network-delivered via crafted HTML page requiring victim visit (UI:R, PR:N); read-only memory flaw yields high confidentiality and availability impact with no integrity vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:27 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

8.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.1

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.

Technical ContextAI

WebXR is the browser API that enables augmented and virtual reality experiences natively in the browser without plugins. The vulnerability resides in Google Chrome's implementation of this API (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is classified under CWE-125 (Out-of-Bounds Read), a memory safety flaw where code reads data from a memory address beyond the allocated buffer boundary. In a browser rendering context, such flaws are particularly consequential: the WebXR subsystem processes complex 3D scene graph and device input data, and malformed input values can cause the parser or geometry processor to index into adjacent memory regions. This can expose heap contents from the renderer process, which may include cached page data, credentials, or other sensitive user information, or trigger a renderer crash, manifesting as a tab crash rather than a full browser shutdown due to Chrome's sandboxed multi-process architecture.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will apply this in most consumer and managed deployments; verify the installed version via chrome://settings/help or enterprise management tooling. For organizations that cannot immediately deploy the update, a compensating control is to restrict or block access to WebXR-dependent web applications via web filtering or browser policy (e.g., disabling the WebXR Device API via enterprise policy flags where supported) - note this will break legitimate immersive web experiences and productivity tools that rely on WebXR. No other confirmed workarounds are available from the referenced data.