CVE-2026-17673
Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 0.48%
- CWE
- CWE-190
- Published
- 2026-07-30
- Last modified
- 2026-07-30
Affected products
- Google Chrome
Weakness type
Related vulnerabilities
- CVE-2026-89158 — PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant...
- CVE-2026-89157 — PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an...
- CVE-2026-88914 — Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
- CVE-2026-16174 — Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
- CVE-2026-88035 — Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
- CVE-2026-85228 — Integer overflow in tensor buffer validation in Deep Java Library
- CVE-2026-88015 — rclone local: crafted Range request against a translated symlink panics (DoS)
- CVE-2026-87823 — zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods