What is the CVSS score of CVE-2026-17951?

CVE-2026-17951 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17951?

Google Chrome's WebRTC component contains an out-of-bounds memory read vulnerability affecting all Chrome users; successful exploitation could disclose sensitive heap memory when employees visit a…. A patch is available.

How to fix or mitigate CVE-2026-17951?

Within 24 hours: Audit current Chrome versions deployed across all endpoints to identify exposure scope and establish a patch deployment timeline. Within 7 days: Deploy Chrome 151.0.7922.72 or later to all endpoints using automated patch management; prioritize completion to minimize the exploitation window. Within 30 days: Verify deployment completion across the entire fleet and implement any post-patch validation required by your IT governance processes.

Google Chrome CVE-2026-17951

EUVD-2026-50877 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-30 Chrome

GHSA-f4qf-989f-24qq

Buffer Overflow Google Heap Overflow

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Remote crafted page needs user interaction (UI:R); the primitive is an out-of-bounds read so confidentiality is limited (C:L) with a possible crash (A:L) and no integrity impact, matching Chromium's Low rating.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:35 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.

Technical ContextAI

The vulnerability lives in WebRTC, the real-time audio/video/data communication stack Chromium ships for peer-to-peer media in the browser. WebRTC parses and processes attacker-influenceable media and signaling data, and a malformed input causes a read past the bounds of a heap allocation (CWE-122, heap-based buffer overflow manifesting as an out-of-bounds read). Because WebRTC processing can be reached from JavaScript/HTML content, a crafted page is sufficient to hit the vulnerable code path. The single affected product per the CPE data is the Chrome desktop browser (cpe:2.3:a:google:chrome:*), fixed in the 151.0.7922.72 stable channel build.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Menu > Help > About Google Chrome) or by pushing the update through enterprise management, then relaunch the browser to load the patched build; the advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Confirm managed fleets are not pinned to an older channel or running with auto-update disabled, the most common reason endpoints stay vulnerable. As an interim compensating control where patching is delayed, disabling WebRTC (via enterprise URL-blocklist policy or a WebRTC-blocking extension) removes the affected attack surface at the cost of breaking video conferencing and other real-time-communication features.