CVE-2026-17694 describes a use-after-free flaw in the browser’s DOM handling that can be triggered by a specially crafted HTML page. The flaw allows a remote attacker to execute arbitrary code inside Chrome’s sandbox, which is a classic memory corruption error categorized as CWE‑416. The primary impact is the ability to run code in the browser context, compromising confidentiality or integrity of the user’s data within that sandbox.

The vulnerability affects Google Chrome browsers running any version prior to 151.0.7922.72. It was addressed in the 151.0.7922.72 release, which was rolled out to the stable channel in July 2026. Any machine still on an older stable build remains vulnerable.

The CVSS base score of 8.8 signals high severity, while the EPSS score of less than 1% indicates that exploitation attempts are uncommon as of this assessment and the vulnerability is not listed in the CISA KEV catalog. Attackers can potentially exploit the flaw by delivering a crafted HTML page to the victim’s browser—e.g., via email, a malicious website, or other remote content. Once executed inside the sandbox, the attacker could exfiltrate data or pivot to other resources, though the sandbox limits direct system compromise. Based on the description, it is inferred that the attack vector involves a remote design of an HTML page that the victim’s browser will process.