What is the CVSS score of CVE-2026-17930?

CVE-2026-17930 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17930?

A sandbox-escape vulnerability in Google Chrome (CVE-2026-17930, CVSS 7.5) allows attackers who have compromised a browser tab to escalate privileges and gain system-level access, affecting all…. A patch is available.

How to fix or mitigate CVE-2026-17930?

Within 24 hours, notify IT and end users that Chrome updates must be applied and verify patch availability in your deployment system. Within 7 days, deploy Chrome 151.0.7922.72 or later to all managed devices via your standard patch management tool; instruct users on unmanaged systems to apply the patch via Settings > About Chrome for automatic updates. Within 30 days, audit extension policies to confirm users cannot install untrusted browser extensions that might trigger this escalation chain, and confirm 100% deployment coverage.

Google Chrome CVE-2026-17930

EUVD-2026-50856 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-hj88-gg4j-wpmr

Privilege Escalation Google

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H and UI:R because exploitation requires a pre-compromised renderer plus loading a crafted page; PR:N as no user authentication is needed, with high sandbox-escape impact across C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:30 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome's Extensions component before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of that sandbox context by serving a crafted HTML page. Chromium rated the underlying issue Low severity, and there is no public exploit identified at time of analysis, though the fix ships in the July 2026 Stable channel desktop update. The bug stems from insufficient validation of untrusted input (CWE-20) crossing the extensions trust boundary.

Technical ContextAI

The flaw lives in Chrome's Extensions subsystem, the browser layer that mediates between untrusted web content, the renderer, and higher-privilege browser/extension APIs. Because the affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* the issue is in the Chrome application itself (Chromium engine) rather than any specific third-party extension. The root cause is CWE-20 (Improper Input Validation): input arriving from an already-compromised renderer is not sufficiently validated before it is acted upon by more-privileged extension handling logic, allowing that validation gap to be leveraged to escalate privileges beyond the renderer sandbox.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop Stable channel; this is the primary and complete fix, delivered via the standard Chrome auto-update (verify via chrome://settings/help and relaunch to apply). See the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through your enterprise policy/update server and confirm the minimum version. As an interim compensating control until updates propagate, restrict or vet installed extensions and enforce ExtensionInstallAllowlist/Blocklist policies to shrink the extensions attack surface, and consider enabling site isolation and strict renderer sandboxing (defaults) - noting these do not fully close the gap and the trade-off is reduced extension flexibility for users. Because exploitation requires a prior renderer compromise, keeping Chrome fully patched against renderer bugs also breaks the required chain.