What is the CVSS score of CVE-2026-17990?

CVE-2026-17990 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17990?

Google Chrome desktop versions before 151.0.7922.72 contain a critical sandbox escape vulnerability (CVSS 9.6) in the WebAuthn implementation that allows attackers with pre-existing renderer process…. A patch is available.

How to fix or mitigate CVE-2026-17990?

Within 24 hours, audit Chrome installations to identify systems running versions before 151.0.7922.72. Within 7 days, initiate staged deployment of Chrome 151.0.7922.72 or later using enterprise update mechanisms and mobile device management platforms. Complete full remediation across all endpoints within 30 days. Verify that Chromium-based alternatives including Microsoft Edge and Brave have applied corresponding vendor patches.

Google Chrome CVE-2026-17990

EUVD-2026-50916 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-vj3f-x3cj-5hwv

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires an already-compromised renderer (PR:H) and a multi-stage chain plus user-opened PDF (AC:H, UI:R); sandbox escape crosses the trust boundary (S:C) with total technical impact (C/I/A:H).

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:38 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who has already compromised the renderer process abuse insufficient input validation in the WebAuthn implementation, using a crafted PDF file to break out of the renderer sandbox and gain higher-privilege code execution. Google's Chrome team reported the flaw internally and rated it 'Low' severity within Chromium, even though NVD scores it 9.6 (Critical); there is no public exploit identified at time of analysis and CISA SSVC lists exploitation status as none. EPSS is very low at 0.16% (6th percentile), consistent with a second-stage bug that requires a pre-existing renderer compromise rather than a directly weaponizable entry point.

Technical ContextAI

The vulnerability lives in Chrome's WebAuthn (Web Authentication API) handling, which brokers requests between web content and platform authenticators for passwordless/2FA credentials. The root cause is classed as CWE-20 (Improper Input Validation): untrusted input flowing from the sandboxed renderer to a more privileged process is not sufficiently validated, and delivery via a crafted PDF (Chrome renders PDFs through its built-in PDFium component inside the renderer) provides the trigger. Because the exploit path crosses the renderer/browser sandbox boundary, a successful attack results in a scope change (CVSS S:C) - code that should be confined to the low-privilege sandbox escapes into a security context it should not reach. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application across platforms prior to the fixed build.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome normally auto-updates, so verify via chrome://settings/help and relaunch to apply, and confirm managed/enterprise fleets are not pinned to an older pinned build. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue https://issues.chromium.org/issues/520018012. If immediate patching is not possible, compensating controls target the delivery and prerequisite steps: disable Chrome's built-in PDF viewer (set 'Download PDFs instead of automatically opening them' / the AlwaysOpenPdfExternally enterprise policy) so crafted PDFs are not rendered in-browser - trade-off is loss of inline PDF viewing convenience; and reduce the risk of the required prior renderer compromise by keeping site isolation enabled and restricting untrusted browsing. Also update any Chromium-derived browsers once their vendors ship the corresponding fix. Do not rely on WebAuthn-usage restrictions as a control, since the exploit is delivered via PDF rather than legitimate WebAuthn flows.