What is the CVSS score of CVE-2026-17924?

CVE-2026-17924 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17924?

Google Chrome desktop versions before 151.0.7922.72 contain a critical-severity sandbox escape (CVE-2026-17924) that could allow attackers with existing renderer process compromise to escalate to…. A patch is available.

How to fix or mitigate CVE-2026-17924?

Within 24 hours, inventory Chrome desktop versions across your organization and flag all installations running versions prior to 151.0.7922.72 for immediate patching. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all affected endpoints using your standard patch management process. Within 30 days, verify patch compliance and generate attestation that the vulnerability has been remediated across your fleet.

Google Chrome CVE-2026-17924

EUVD-2026-50673 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-7xmf-5qm5-jq3w

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via crafted page with UI:R, but AC:H because it demands a pre-compromised renderer and precise heap grooming; scope changes (S:C) on sandbox escape with total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

3.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:34 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox by triggering a use-after-free in the browser's DNS handling via a crafted HTML page. Chromium rated the issue Low severity, and while the NVD CVSS is 9.6, SSVC records no observed exploitation and it is not automatable; there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is low at 0.17% (7th percentile), consistent with a second-stage chaining bug rather than a mass-exploited entry point.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's DNS subsystem, which resolves hostnames on behalf of the browser process. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker to reallocate that memory with controlled data and corrupt program state. Because DNS resolution logic runs in the privileged browser process rather than the sandboxed renderer, corrupting it from a compromised renderer provides a path across Chrome's renderer/browser trust boundary - the essence of a sandbox escape. The affected component is Google Chrome (cpe:2.3:a:google:chrome:*), the Chromium-based desktop browser, on the Stable channel prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later (Stable channel), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; relaunch the browser to apply the update since Chrome patches only take effect after restart. In managed environments, push the update via your enterprise update policy and confirm forced relaunch to close the window on unpatched sessions. No standalone workaround fully removes the DNS use-after-free, but because exploitation requires a prior renderer compromise, keeping the site-isolation sandbox enabled (default), restricting untrusted browsing, and ensuring any renderer-level RCEs are also patched materially reduce the chance this bug is reachable; the trade-off of these controls is only reduced attack surface, not a substitute for the update.