What is the CVSS score of CVE-2026-17947?

CVE-2026-17947 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17947?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17947, CVSS 9.6) enabling arbitrary code execution when users visit malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-17947?

Within 24 hours, audit all Chrome installations organization-wide to identify current versions and deployment locations. Within 7 days, deploy Chrome 151.0.7922.72 or later to all endpoints through standard patch management, prioritizing users in high-risk roles. Verify 100% deployment compliance and document results by day 30.

Google Chrome CVE-2026-17947

EUVD-2026-50873 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-9474-jh72-xhvr

Denial Of Service Google Use After Free Memory Corruption

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via a crafted page with required user interaction and no auth, but reliably weaponizing a heap UAF into a sandbox escape raises complexity to AC:H; scope changes on sandbox escape with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:32 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome's WebSockets implementation (versions prior to 151.0.7922.72) allows a remote attacker to potentially break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 9.6 due to a scope-changing sandbox escape, though Google's own Chromium severity rating is only Low and EPSS exploitation probability is minimal (0.17%). No public exploit has been identified and CISA SSVC lists exploitation status as none.

Technical ContextAI

The vulnerability lives in Chrome's WebSockets subsystem, the browser API that maintains full-duplex TCP connections between JavaScript in a web page and a remote server. The root cause is a use-after-free (CWE-416): a heap object tied to a WebSocket is freed while a dangling pointer to it remains reachable, so subsequent access operates on reclaimed or attacker-controlled memory. Because WebSocket handling spans the sandboxed renderer and browser-process boundary, a controlled UAF here is what elevates the issue from a renderer-only bug to a potential sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build), i.e. the desktop Chrome stable channel on the Blink/Chromium engine.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop stable channel, as announced in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome normally auto-updates, so verify the version under chrome://settings/help and relaunch to apply. Enterprises managing Chrome via policy should push the updated build and force a browser restart to ensure the fix takes effect. There is no vendor-documented configuration workaround, but interim risk can be reduced by ensuring the browser sandbox is not disabled (never run with --no-sandbox) and by using web filtering to limit exposure to untrusted pages that could deliver a crafted WebSocket payload - noting these measures reduce but do not eliminate exposure and are no substitute for the update. Downstream Chromium-based browsers should be updated once they ship a build incorporating the upstream fix.