What is the CVSS score of CVE-2026-18017?

CVE-2026-18017 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-18017?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the WebGPU graphics component affecting all desktop users.. A patch is available.

How to fix or mitigate CVE-2026-18017?

Within 24 hours, identify all Chrome versions deployed across your organization using endpoint management and flag machines running builds prior to 151.0.7922.72 for priority patching. Within 7 days, begin rolling out Chrome 151.0.7922.72 or later through your patch management system with automatic updates enabled where possible. Complete deployment across all desktop endpoints by day 30, with priority given to high-risk users including finance, legal, and executive staff.

Google Chrome CVE-2026-18017

EUVD-2026-50943 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-434r-58rq-9884

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only a victim visit (AV:N/AC:L/PR:N/UI:R); renderer RCE yields full C/I/A within the unchanged sandbox scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:31 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Memory-corruption remote code execution in Google Chrome's Dawn WebGPU graphics component affects all Desktop builds prior to 151.0.7922.72, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code - though confined inside the renderer sandbox, which is why Chromium rated it Low despite the CVSS 8.8. Exploitation requires only that a victim load a malicious page (UI:R), with no authentication. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU API, the successor to WebGL that gives web pages low-level access to GPU compute and rendering. It parses and validates GPU commands originating from untrusted JavaScript, making it a rich attack surface for memory-safety bugs. The flaw is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer allows an attacker to corrupt heap memory and hijack control flow. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application; because Dawn is also embedded in other Chromium-based browsers (Edge, Brave, Opera, Electron apps), downstream products built on the same engine may share the underlying defect.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Desktop channel (chrome://settings/help forces the update check, then relaunch to apply). Enterprise fleets should push the update through their managed-browser channel and confirm relaunch, since Chrome's background updater does not take effect until restart. Reference advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, reduce exposure by disabling WebGPU via enterprise policy or the chrome://flags/#enable-unsafe-webgpu toggle, which removes the Dawn attack surface at the cost of breaking GPU-accelerated web applications; avoiding untrusted sites and maintaining standard sandbox hardening further limit risk. Users of other Chromium-based browsers should apply their vendor's corresponding Dawn update when released.