What is the CVSS score of CVE-2026-17886?

CVE-2026-17886 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17886?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the browser's core component; a threat actor could execute arbitrary code within the browser process…. A patch is available.

How to fix or mitigate CVE-2026-17886?

Within 24 hours, begin staged deployment of Chrome version 151.0.7922.72 stable channel to critical-function endpoints using your organization's MDM or patch management platform. Within 7 days, complete deployment to all employee Chrome instances and verify successful update via endpoint compliance reporting. Within 30 days, audit your entire Chrome deployment for any remaining legacy versions and establish automatic update enforcement to prevent exposure to similar memory-safety vulnerabilities in future browser releases.

Google Chrome CVE-2026-17886

EUVD-2026-50635 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-qgw6-jjq5-76g9

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page with no auth (AV:N/PR:N) but mandatory user interaction (UI:R); a UAF enabling code execution gives high C/I/A within the unchanged browser process scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:35 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in the Enterprise component of Chromium, the open-source engine underpinning Google Chrome (CPE cpe:2.3:a:google:chrome). Use-after-free occurs when a pointer to heap memory continues to be used after that memory has been freed, letting an attacker reclaim the freed allocation with attacker-controlled data and corrupt the heap. In a browser context, an attacker triggers the dangling reference from JavaScript/HTML rendering, and Chrome's high-value renderer process makes such bugs a common stepping stone toward code execution, typically requiring a further sandbox escape for full system compromise. The 'Enterprise' subsystem indicates the vulnerable code path relates to Chrome's managed/policy features rather than the core DOM.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; on most deployments Chrome auto-updates, so verify the version under chrome://settings/help and relaunch to apply. In managed enterprise fleets, push the update through your management tooling (e.g., Chrome Browser Cloud Management or OS patch management) and force a relaunch, since users who never restart the browser remain exposed. No specific vendor workaround is published; as an interim compensating control you can restrict browsing to trusted sites or enforce Chrome's site isolation and safe-browsing policies, accepting the trade-off that these reduce but do not eliminate exposure to a crafted-page attack.