What is the CVSS score of CVE-2026-17987?

CVE-2026-17987 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17987?

Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape (CVE-2026-17987, CVSS 9.6) that enables unrestricted code execution through maliciously crafted PDFs.. A patch is available.

How to fix or mitigate CVE-2026-17987?

Within 24 hours, inventory Chrome deployments across the organization and prioritize users with frequent PDF handling or exposure to untrusted documents. Within 7 days, stage pilot rollout of Chrome 151.0.7922.72 or later to a test cohort and validate compatibility with internal systems and extensions. Within 30 days, mandate Chrome 151.0.7922.72 or later organization-wide and verify zero instances below this version remain in active use.

Google Chrome CVE-2026-17987

EUVD-2026-50913 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-qw96-7rhh-gvmj

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Requires a prior renderer compromise plus a crafted PDF, so AC:H and UI:R; the sandbox escape crosses a trust boundary (S:C) with full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:30 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

9.6 (None) 9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox by feeding a crafted PDF through the Notifications component, which insufficiently validates untrusted input (CWE-20). Full technical impact (SSVC: total) means a successful escape yields code execution outside the constrained renderer. Despite a 9.6 CVSS, Chromium rated this Low severity, EPSS is 0.16%, and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in Chrome's Notifications handling of data originating from a crafted PDF, an area that processes content already inside the browser's multi-process security model. Chrome isolates untrusted web/PDF rendering in a sandboxed renderer process; a sandbox escape (CVSS S:C, scope changed) crosses that trust boundary into the more-privileged browser process. The root cause is CWE-20 (Improper Input Validation): untrusted input reaching the Notifications logic is not sufficiently validated, enabling the renderer-to-browser boundary to be violated. The single affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all versions prior to the fix.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Channel; a patch is available from the vendor per the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Restart the browser after updating so the new binary is loaded, and confirm the version at chrome://settings/help. As a compensating control until patching completes, restrict handling of untrusted PDFs - for example, route external PDFs through Chrome's default viewer only from trusted sources, or use enterprise policy to disable inline PDF rendering (AlwaysOpenPdfExternally) so crafted PDFs are handed to an external reader instead of Chrome's renderer; the trade-off is degraded in-browser PDF usability. Because exploitation requires a prior renderer compromise, keeping Chrome fully updated (which also closes the renderer-level bugs needed to reach this one) is the most effective mitigation.