What is the CVSS score of CVE-2026-17894?

CVE-2026-17894 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17894?

Google Chrome on Linux versions below 151.0.7922.72 contain a use-after-free vulnerability (CVSS 8.8) capable of enabling arbitrary code execution if exploited.. A patch is available.

How to fix or mitigate CVE-2026-17894?

Within 24 hours, inventory all Linux systems running Google Chrome and communicate the vulnerability and patch availability to affected users. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected systems through your standard patch management process, prioritizing organizational Linux systems and employee workstations. Within 30 days, verify 100% compliance by confirming all Chrome instances on Linux have been updated to version 151.0.7922.72 or later, and document remediation in your vulnerability management system.

Google Chrome CVE-2026-17894

EUVD-2026-50643 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-84j6-88rr-f5r4

Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges (PR:N) but requires the victim to open it (UI:R); a UAF yielding code execution gives high C/I/A within the unchanged process scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:37 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework on Linux affects all versions prior to 151.0.7922.72, where a remote attacker can leverage a use-after-free by luring a victim to a crafted HTML page. Because exploitation requires the user to visit malicious content (UI:R), it is not fully automatable, and there is no public exploit identified at time of analysis; EPSS estimates only a 0.18% exploitation probability (8th percentile) and SSVC records exploitation status as none. Chromium rated the underlying issue Medium severity, though the CVSS base score is 8.8 due to high confidentiality, integrity, and availability impact if successfully exploited.

Technical ContextAI

The flaw resides in Views, Chromium's cross-platform C++ UI toolkit used to render browser chrome and native widgets rather than web page content. The root cause is CWE-416 (Use After Free): an object in the Views subsystem is freed while a dangling reference remains reachable, and subsequent access to that stale pointer corrupts the heap. Attacker-controlled HTML/JS can drive the sequence of UI operations that triggers the premature free and reuse, giving the attacker influence over the contents of the freed-then-reallocated memory. Per the CPE (cpe:2.3:a:google:chrome:*), the affected artifact is the Google Chrome desktop application, with this advisory specifically scoping the Linux build.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Linux via the Stable channel (relaunch the browser to complete the update), per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, ensure background updates are not disabled in managed/enterprise fleets and force a policy-driven update where necessary; verify the running version under chrome://settings/help. As an interim compensating control before patching, restrict users from browsing untrusted sites and consider enforcing site isolation and the renderer sandbox (default-on) to raise exploitation cost - note this does not remediate the flaw and only reduces likelihood of a successful chain. Downstream Chromium-based browsers on Linux should be updated to a build incorporating the equivalent Views fix.