What is the CVSS score of CVE-2026-17995?

CVE-2026-17995 has a contested CVSS base score of 8.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17995?

Google Chrome versions before 151.0.7922.72 contain an out-of-bounds memory read vulnerability in the WebGPU component, triggered when users visit a crafted website.. A patch is available.

How to fix or mitigate CVE-2026-17995?

Within 24 hours: inventory Chrome installations across managed devices and identify any systems handling sensitive data or prone to phishing. Within 7 days: deploy Chrome 151.0.7922.72 or later through your standard patch management process to all user-facing systems, targeting minimum 90% compliance. Within 30 days: verify 100% patch deployment completion, audit WebGPU settings on critical systems if business-relevant, and enforce automatic Chrome updates via group policy to prevent future delays.

Google Chrome CVE-2026-17995

EUVD-2026-50921 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 Chrome

GHSA-f7m3-wmcx-qrxq

Buffer Overflow Information Disclosure Google

High

Disputed · 8.1 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

vuln.today AI

5.4 MEDIUM

Remote crafted page needs user interaction (UI:R) but no auth; as a sandboxed OOB read rated 'Low' by Chromium, confidentiality and availability impact are limited (C:L/A:L), not high.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:24 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

8.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

HIGH 8.1

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU API, translating web-facing GPU calls into native Metal/Vulkan/D3D12/OpenGL commands; it runs largely within the renderer/GPU process and parses untrusted, web-supplied graphics workloads. The flaw is CWE-125 (Out-of-bounds Read), meaning code reads past the end (or before the start) of an allocated buffer - typically from missing or incorrect bounds validation on an index, length, or offset derived from attacker-controlled WebGPU input. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and it is triggered purely through content rendered from a crafted HTML page that exercises the WebGPU/Dawn code path.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel; Chrome normally auto-updates, so the primary action is to relaunch the browser to apply the pending update and confirm the version under chrome://settings/help across managed fleets. Follow the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the issue tracker at https://issues.chromium.org/issues/520972775. If patching must be delayed, a specific compensating control is to disable WebGPU (set chrome://flags/#enable-unsafe-webgpu to Disabled, or enforce via enterprise policy) so the vulnerable Dawn code path is not reachable from web content; the trade-off is that any legitimate WebGPU-based sites or apps will lose GPU acceleration/functionality. Restricting exposure to untrusted pages (site isolation is already on by default) further limits opportunity but is not a substitute for the update.