Description
Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from insufficient validation of untrusted input in the Variations component of Google Chrome, which can lead to heap corruption. This flaw is identified as both CWE-20 and CWE-787, representing an input validation problem that can result in a heap buffer overflow. Based on the description, it is inferred that causing such corruption could compromise the integrity or availability of the browser.

Affected Systems

Google Chrome versions prior to 151.0.7922.72 on desktop operating systems are affected. The flaw applies to all major platforms supported by the Chrome stable channel.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, and with an EPSS score of < 1% the likelihood of exploitation remains low according to industry metrics. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to deliver malformed network traffic from a privileged network position to exploit the heap corruption in the Variations component of Chrome. The weakness is a combination of CWE-20 and CWE-787.

Generated by OpenCVE AI on August 4, 2026 at 12:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or later as published in the official patch advisory.
  • Ensure that Chrome’s automatic update feature is enabled so that future security patches are applied promptly.
  • Consult Chrome release notes or security advisories for any additional mitigations until the patch reaches all devices.

Generated by OpenCVE AI on August 4, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Sat, 01 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Insufficient validation of untrusted input in Variations
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 30 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T03:55:37.731Z

Reserved: 2026-07-27T23:34:42.725Z

Link: CVE-2026-17774

cve-icon Vulnrichment

Updated: 2026-07-30T12:30:47.575Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:40.670

Modified: 2026-08-04T14:31:15.930

Link: CVE-2026-17774

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:17Z

Links: CVE-2026-17774 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:15:03Z

Weaknesses