Is CVE-2026-17680 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17680 being exploited in the wild.

How severe is CVE-2026-17680?

Informational severity, published 30 July 2026.

Which products and versions are affected?

Google ChromeOS prior to 151.0.7922.72.

Is there a fix for CVE-2026-17680?

A patch was published on 2026-07-29: Fixed in stable channel update 151.0.7922.72 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17680 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-17680?

Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17680: Google ChromeOS heap buffer overflow in Color component

CVE-2026-17680 · Severity: info · Published 2026-07-30

A security vulnerability exists in the Color component of Google Chrome on ChromeOS. This flaw could allow a malicious website to break out of the browser's security sandbox if the browser's rendering process has already been compromised. Successfully exploiting this could give an attacker deeper access to the underlying operating system, potentially leading to unauthorized data access or full system control.

Technologies: Google ChromeOS. Vendors: Google.

Quick answers

Is CVE-2026-17680 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17680 being exploited in the wild.
How severe is CVE-2026-17680?: Informational severity, published 30 July 2026.
Which products and versions are affected?: Google ChromeOS prior to 151.0.7922.72.
Is there a fix for CVE-2026-17680?: A patch was published on 2026-07-29: Fixed in stable channel update 151.0.7922.72 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17680 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-17680?: Check whether you run Google ChromeOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as a heap-based buffer overflow (CWE-122) within the Color component of Google Chrome on ChromeOS. The flaw is reachable via a crafted HTML page. A precondition for this exploit is a prior compromise of the renderer process. If achieved, a remote attacker can leverage this overflow to bypass the browser sandbox and execute code in the context of the operating system. Google has addressed this issue in ChromeOS version 151.0.7922.72.

Affected products

Google ChromeOS prior to 151.0.7922.72

Timeline

2026-05-25: disclosed: Reported to Chromium project
2026-07-29: patched: Fixed in stable channel update 151.0.7922.72
2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.