What is the CVSS score of CVE-2026-17884?

CVE-2026-17884 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17884?

A heap corruption vulnerability in Google Chrome's WebRTC component (CVE-2026-17884) enables remote code execution when users visit a malicious webpage, directly compromising Chrome instances across…. A patch is available.

How to fix or mitigate CVE-2026-17884?

Within 24 hours, confirm Chrome deployment scope and test Google Chrome 151.0.7922.72 patch in a lab environment for compatibility with critical applications and plugins. Over the next 7 days, deploy to high-risk populations (finance, engineering, senior staff) using endpoint management tools and monitor deployment success rates. Complete organization-wide rollout by day 30, ensuring all Chrome instances reach version 151.0.7922.72, with web content filtering and browser sandboxing policies active as compensating controls during transition.

Google Chrome CVE-2026-17884

EUVD-2026-50633 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-g442-2whp-xfm3

Google Use After Free Memory Corruption Information Disclosure Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via a web page with no auth, but reliable UAF exploitation needs heap grooming (AC:H) and victim must visit the page (UI:R).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:28 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Malicious JS drives WebRTC path

Exploit

Trigger use-after-free / heap corruption

Execution

Achieve code execution in renderer

Impact

Chain sandbox escape for full compromise

Access

Lure victim to crafted HTML page

Delivery

Malicious JS drives WebRTC path

Exploit

Trigger use-after-free / heap corruption

Execution

Achieve code execution in renderer

Impact

Chain sandbox escape for full compromise

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome build (prior to 151.0.7922.72) and requires the WebRTC code path to be reachable - WebRTC APIs are available to any page by default, so no special browser configuration is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals partially conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing crafted JavaScript that drives WebRTC into the vulnerable object-lifecycle path. When a victim running a pre-151.0.7922.72 Chrome visits, the use-after-free corrupts the heap and the attacker attempts to gain code execution or leak memory in the renderer. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel; the fix is delivered via Chrome's automatic updater, so verify at chrome://settings/help and relaunch to apply, since the update is inert until restart. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm Chrome deployment scope and test Google Chrome 151.0.7922.72 patch in a lab environment for compatibility with critical applications and plugins. …

Threat intelligence, references, and detailed analysis are available after sign-in.