What is the CVSS score of CVE-2026-17935?

CVE-2026-17935 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17935?

Google Chrome versions before 151.0.7922.72 contain a remote code execution vulnerability that affects all employees using Chrome.. A patch is available.

How to fix or mitigate CVE-2026-17935?

Within 24 hours, inventory Chrome versions across the organization to identify affected systems running versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 stable channel across all endpoints using your standard patch management process, leveraging Chrome's automatic update mechanism where available. Within 30 days, audit patch deployment metrics to confirm 100% organizational compliance; escalate any unpatched systems for immediate remediation.

Google Chrome CVE-2026-17935

EUVD-2026-50861 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-30 Chrome

GHSA-5jcv-xqp8-f3wf

RCE Buffer Overflow Google Heap Overflow

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs user to visit (UI:R) but no auth (PR:N); overflow gives full control of the sandboxed renderer (C/I/A:H) with no scope change to the host (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:34 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.

Technical ContextAI

The flaw lives in Chrome's Codecs subsystem, the media-decoding path that parses and renders audio/video streams embedded in web content. CWE-122 (heap-based buffer overflow) means attacker-controlled input - malformed codec/container data delivered through an HTML page - causes a write past the bounds of a heap allocation, corrupting adjacent heap metadata or objects and creating a controllable memory-corruption primitive that can be steered toward code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome desktop application. Notably, the description states execution occurs 'inside a sandbox,' indicating the bug compromises the sandboxed renderer process and does not by itself constitute a sandbox escape to the underlying operating system, which typically requires a second chained vulnerability.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later on the stable desktop channel via Help > About Google Chrome (which triggers the update) followed by a browser relaunch, per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the updated version through your existing browser management/MDM policy and force a relaunch to apply it. If patching must be delayed, the practical compensating control is to reduce exposure to untrusted media content - for example enforcing Site Isolation (default on) and restricting browsing to trusted sites; note that disabling media codecs is not a supported end-user configuration and blunt network filtering of media is impractical, so upgrading remains the only reliable fix.