What is the CVSS score of CVE-2026-17969?

CVE-2026-17969 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17969?

All Google Chrome desktop browsers below version 151.0.7922.72 are vulnerable to remote code execution attacks through malicious websites, risking employee workstation compromise and credential…. A patch is available.

How to fix or mitigate CVE-2026-17969?

Within 24 hours, issue an urgent security alert to all Chrome desktop users verifying they are running version 151.0.7922.72 or later (currently rolling out via Stable channel), and confirm auto-update is enabled across your environment. Within 7 days, audit your endpoint management systems to verify at least 95% of desktop systems have deployed the patched version, and escalate any systems still running versions prior to 151.0.7922.72 for immediate remediation. Within 30 days, complete 100% deployment verification, document the patch deployment timeline in your vulnerability management system, and establish a baseline expectation that Chrome updates are deployed within 14 days of vendor release.

Google Chrome CVE-2026-17969

EUVD-2026-50895 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-xxfq-g4g6-2pwg

Privilege Escalation RCE Google Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.3 MEDIUM

Remote crafted page with required user interaction and no auth (AV:N/AC:L/PR:N/UI:R), but code runs only inside the sandbox with no scope change, so impacts are Low rather than High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:31 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution within the browser's renderer sandbox affects Google Chrome desktop builds prior to 151.0.7922.72, stemming from an inappropriate implementation in the Passwords component (CWE-269). A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code, but execution is confined to the sandbox - which is why Chromium rated the underlying issue Low severity despite the CVSS 8.8. No public exploit identified at time of analysis, and the fix is already shipping in the Stable channel.

Technical ContextAI

Chrome is a Chromium-based web browser whose renderer processes run inside a multi-layer OS sandbox designed to contain code execution triggered by untrusted web content. This flaw lives in the Passwords feature (credential storage/autofill) and is classified CWE-269 (Improper Privilege Management), indicating the component acts with or grants privileges it should not when processing attacker-influenced input. The affected CPE is cpe:2.3:a:google:chrome:*, covering the desktop application across platforms; because the arbitrary code executes 'inside a sandbox,' the attacker gains control only over the confined renderer context and would need to chain a separate sandbox-escape bug to reach the host OS.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72. Update to 151.0.7922.72 or later via the Stable desktop channel and relaunch the browser to apply it, then confirm the version under chrome://settings/help; managed fleets should push the update through their existing browser management or MDM tooling per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). No standalone workaround is published; as an interim compensating control, ensure Chrome's sandbox is not disabled (avoid the --no-sandbox flag) and limit users from visiting untrusted sites, accepting that this restricts functionality but preserves the containment that keeps this bug low-impact.