What is the CVSS score of CVE-2026-17971?

CVE-2026-17971 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17971?

Google Chrome desktop versions before 151.0.7922.72 contain an out-of-bounds memory access vulnerability in the Frame component with potential remote code execution capability; remote attackers can…. A patch is available.

How to fix or mitigate CVE-2026-17971?

Within 24 hours, issue a security alert advising users to avoid untrusted websites and defer opening links from suspicious sources. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all endpoints via your MDM solution to ensure complete patch coverage. Within 30 days, verify deployment success through system inventory and audit logs, and monitor security telemetry for any exploitation attempts.

Google Chrome CVE-2026-17971

EUVD-2026-50897 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-3wv5-vww2-4hrq

Buffer Overflow Information Disclosure Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Remote crafted page needs user interaction (UI:R, PR:N); CWE-125 OOB read primarily leaks memory (C:H) with possible crash (A:L) and no clear integrity impact, matching Chromium's Low rating.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.

Technical ContextAI

The defect lives in Chrome's Frame handling, part of the Blink rendering engine that manages nested browsing contexts (iframes, frame trees) inside the multi-process Chromium architecture. The root cause is CWE-125 (Out-of-bounds Read): logic in the frame code computes an index or length incorrectly and accesses memory past the end of an allocated buffer while parsing or processing attacker-controlled HTML. Per CPE data this affects cpe:2.3:a:google:chrome across versions below 151.0.7922.72. OOB reads in a renderer can leak adjacent heap contents (potentially defeating ASLR or exposing cross-site data) and, if the corrupted read feeds later control flow, may be chained toward the 'Potential RCE' outcome noted in the tags - though on its own an OOB read is primarily an information-disclosure/stability class.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the Stable Desktop channel (chrome://settings/help forces the check-and-relaunch) as documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through your enterprise policy/patch-management channel and ensure users fully relaunch Chrome so the new binary loads. Because exploitation requires the victim to open a crafted page, interim compensating controls include enabling Site Isolation (default) and, for high-risk users, restricting untrusted browsing or using web-content filtering to reduce exposure to attacker pages; these reduce likelihood but do not remove the flaw, so patching remains the only complete fix. Users of other Chromium-based browsers should apply the equivalent vendor update once released.