What is the CVSS score of CVE-2026-17887?

CVE-2026-17887 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17887?

A vulnerability in Google Chrome desktop (CVE-2026-17887) could allow attackers to execute code on users' systems when they visit a malicious webpage; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-17887?

Within 24 hours, identify and catalog all Google Chrome desktop deployments across the organization, and issue a security alert to users advising them to avoid visiting untrusted websites until patched. Within 7 days, begin deployment of Chrome version 151.0.7922.72 or later, leveraging automatic update mechanisms where available or pushing updates through device management systems to accelerate remediation. Within 30 days, verify that all desktop Chrome instances have been updated to Chrome 151.0.7922.72 or later through audit logs and device inventory systems, and monitor security feeds for any emergence of active exploitation.

Google Chrome CVE-2026-17887

EUVD-2026-50636 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-pgpx-v7pf-c78w

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via crafted page (AV:N) but needs specific user gestures and heap grooming (AC:H, UI:R), no auth (PR:N); UAF can yield full renderer compromise (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:36 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

7.5 (None) 7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in the TabStrip component of Google Chrome desktop before 151.0.7922.72 allows a remote attacker to trigger a use-after-free (CWE-416) when a user is lured to a crafted HTML page and performs specific UI gestures. Successful exploitation could lead to arbitrary code execution within the renderer process, though Chromium rates the severity as Medium and there is no public exploit identified at time of analysis. EPSS is low at 0.22% (12th percentile) and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's TabStrip, the browser-UI component that manages the row of open tabs. Use-after-free bugs occur when a heap object is freed while a dangling pointer to it remains in use, letting an attacker reclaim and control that freed memory to corrupt the heap. The affected surface is the desktop Chrome browser (CPE cpe:2.3:a:google:chrome), and because TabStrip is browser-process/UI-adjacent, the trigger depends on user-driven interface actions rather than pure content parsing, which raises exploitation complexity relative to a typical renderer bug.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on most installs this happens automatically but should be forced by navigating to chrome://settings/help and relaunching. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracker at https://issues.chromium.org/issues/523717010. Because exploitation requires visiting a malicious page and performing UI gestures, interim compensating controls include enforcing browser auto-update policies enterprise-wide, restricting or web-filtering untrusted sites, and cautioning users against unexpected tab-manipulation prompts; these reduce exposure but do not eliminate the underlying bug, so patching remains the only complete fix.