What is the CVSS score of CVE-2026-17922?

CVE-2026-17922 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17922?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability that could allow attackers to compromise employee systems through malicious web pages, requiring only user…. A patch is available.

How to fix or mitigate CVE-2026-17922?

Within 24 hours, issue an urgent security notification directing all users to update Chrome to version 151.0.7922.72 or later using auto-update or manual installation; prioritize administrative and client-facing systems. Within 7 days, verify patch deployment across the organization through endpoint management systems, targeting 95% minimum compliance and escalating non-compliant systems for remediation. Within 30 days, complete final compliance audit, document deployment completion, and implement monitoring for exploitation indicators associated with this vulnerability.

Google Chrome CVE-2026-17922

EUVD-2026-50671 HIGH

Code Injection (CWE-94)

2026-07-30 Chrome

GHSA-prc5-pgx6-37j6

RCE Google Code Injection

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page with no privileges but requiring the user to visit it (UI:R); code execution yields high C/I/A within the unchanged browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:34 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker to run arbitrary code within the browser by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in the Enterprise component and is classed as CWE-94 code injection. No public exploit identified at time of analysis, exploitation requires user interaction (visiting a malicious page), and EPSS risk is low at 0.26% (17th percentile).

Technical ContextAI

The vulnerability lives in Google Chrome's Enterprise-related functionality within the Chromium codebase. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates that attacker-influenced input is treated as executable code rather than inert data, allowing the browser to be coerced into executing attacker-supplied instructions. The affected surface is the desktop Stable channel (cpe:2.3:a:google:chrome:*), which shares its rendering and JavaScript engine (Blink/V8) and policy-handling code across Windows, macOS, and Linux. Notably, Google's Chromium security team rated the underlying bug 'Low' severity, which diverges sharply from the NVD CVSS 8.8 rating and suggests the practical exploit primitive may be more constrained than a raw RCE label implies.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade all desktop Chrome installations to 151.0.7922.72 or later on Windows, macOS, and Linux. Most endpoints receive this automatically via Chrome's built-in updater; verify by opening chrome://settings/help, confirming the running version, then relaunch to apply, since the fix is not active until the browser restarts. In managed/enterprise fleets, push the update through management tooling (Google Admin console, SCCM/Intune, or package managers) and set the RelaunchNotification policy so users actually restart. The authoritative advisory is the Chrome Releases stable-channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). As an interim compensating control until updates land, restrict browsing to trusted sites via enterprise policy or web filtering, since exploitation depends on the user loading a malicious HTML page; the trade-off is reduced usability and it is no substitute for patching.