What is the CVSS score of CVE-2026-17875?

CVE-2026-17875 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17875?

Google Chrome versions prior to 151.0.7922.72 contain a memory safety vulnerability in its PDF rendering engine that allows remote code execution when users open malicious PDF files.. A patch is available.

How to fix or mitigate CVE-2026-17875?

Within 24 hours, inventory Chrome deployments across the organization and prepare a staged update plan targeting Chrome 151.0.7922.72 or later. Within 7 days, deploy the patched version to all endpoints using your standard update mechanism; prioritize employees who handle external documents and contractor-supplied PDFs. Within 30 days, verify 100% deployment completion, document the patch status in your patch management system, and monitor systems for any compromise indicators.

Google Chrome CVE-2026-17875

EUVD-2026-50624 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-gq67-349v-hv27

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered PDF (AV:N/AC:L) with no auth (PR:N) but requiring the user to open it (UI:R); in-sandbox code execution still yields high C/I/A within that scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:27 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.

Technical ContextAI

PDFium is the open-source PDF rendering library embedded in Chromium/Google Chrome that parses and renders PDF documents within the renderer process. The root cause is a use-after-free (CWE-416): a memory object is freed while a dangling reference to it remains, and subsequent access to that reference can be manipulated by a crafted PDF to corrupt heap memory and hijack control flow. Because PDFium runs inside Chrome's renderer sandbox, successful exploitation grants code execution only within that sandboxed context. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop (Stable channel) prior to the fixed build 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to version 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is restarted to apply the fix, and verify via chrome://settings/help. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If patching cannot be completed immediately, compensating controls include disabling Chrome's built-in PDF viewer (set PDFs to download rather than open in-browser via chrome://settings/content/pdfDocuments) so crafted PDFs are not auto-rendered by PDFium - trade-off is reduced usability for legitimate inline PDFs; and blocking or sandboxing untrusted PDF delivery at the email/web gateway. Enterprise fleets should push the update via managed update policy and enforce Site Isolation (default) to keep the renderer sandbox intact as a defense-in-depth layer.