What is the CVSS score of CVE-2026-17881?

CVE-2026-17881 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17881?

Google Chrome users face remote code execution risk from a WebXR implementation flaw (CVE-2026-17881, CVSS 8.8) affecting all versions prior to 151.0.7922.72, which could compromise browser sandbox…. A patch is available.

How to fix or mitigate CVE-2026-17881?

Within 24 hours, issue a security advisory to all Chrome users and IT teams; inventory Chrome deployment methods and establish current version baseline across managed and unmanaged devices. Within 7 days, deploy Chrome 151.0.7922.72 or later through your standard patching mechanism (Group Policy for domain-joined systems, managed browser distribution, or direct user notifications for BYOD); prioritize managed enterprise endpoints. Within 30 days, verify 95% or greater adoption of the patched version across all Chrome instances in your environment, update your vulnerability management records to reflect remediation, and configure security log monitoring for any suspicious WebXR-related activity.

Google Chrome CVE-2026-17881

EUVD-2026-50630 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-pqxg-9927-553c

RCE Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) requires the victim to visit it (UI:R); renderer memory-corruption RCE gives full C/I/A but stays sandboxed, so S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:28 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.

Technical ContextAI

WebXR is the browser API that exposes virtual- and augmented-reality device data (pose tracking, immersive rendering) to web content, processing untrusted geometry and session parameters inside Chrome's renderer process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root-cause signals conflict: the CVE description names an integer overflow (a length/size miscalculation, CWE-190 in spirit), while the assigned CWE-416 (Use After Free) and the vendor tags ('Use After Free', 'Memory Corruption') point to a dangling-pointer dereference. In practice an integer overflow in a WebXR allocation/size computation can lead to undersized buffers and subsequent memory-corruption/UAF primitives, which is consistent with both signals. Exploitation yields code execution confined to the renderer sandbox, not a full host compromise.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later (Stable channel) and restart the browser to load the fix; managed fleets should confirm auto-update is enabled or push the update via enterprise policy. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, a targeted compensating control is to disable WebXR by setting the chrome://flags 'WebXR' / OpenXR runtime flags to Disabled or applying enterprise policy to block the WebXR/VR API and immersive-web content, which removes the vulnerable attack surface at the cost of breaking legitimate AR/VR web experiences (a low-impact trade-off for most enterprise users). Restricting untrusted browsing and ensuring the renderer sandbox remains enabled further limits impact until the update is applied.