Is CVE-2026-17684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17684 being exploited in the wild.

How severe is CVE-2026-17684?

Informational severity, with a CVSS score of 8.8, published 30 July 2026.

Is there a fix for CVE-2026-17684?

A patch was published on 2026-07-29: Fixed in version 151.0.7922.72 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-17684 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-17684?

Check whether you run Google Chrome for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17684: Google Chrome for iOS sandbox escape via improper input validation

CVE-2026-17684 · Severity: info · CVSS 8.8 · Published 2026-07-30

Google Chrome for iOS contains a security vulnerability that could allow a malicious website to bypass the browser's security sandbox. The sandbox is a critical defense layer designed to prevent malicious code from escaping the browser and accessing the rest of the mobile device. If exploited, an attacker who has already gained control over a browser tab could potentially access sensitive user data or perform unauthorized actions on the device.

Technologies: Google Chrome for iOS. Vendors: Google.

Quick answers

Is CVE-2026-17684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17684 being exploited in the wild.
How severe is CVE-2026-17684?: Informational severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?: Google Chrome for iOS prior to 151.0.7922.72.
Is there a fix for CVE-2026-17684?: A patch was published on 2026-07-29: Fixed in version 151.0.7922.72 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17684 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-17684?: Check whether you run Google Chrome for iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Google Chrome for iOS (prior to 151.0.7922.72) classified as improper input validation (CWE-20). The flaw resides in how the application handles untrusted input, which can be leveraged by a remote attacker who has already achieved code execution within the renderer process (e.g., via a separate memory corruption bug). By enticing a user to visit a specially crafted HTML page, the attacker can trigger this insufficient validation to perform a sandbox escape. This allows the attacker to break out of the restricted process environment and potentially execute commands or access data with the privileges of the browser application. The issue was addressed in the stable channel update to version 151.0.7922.72.

Affected products

Google Chrome for iOS prior to 151.0.7922.72

Timeline

2026-05-26: disclosed: Reported to Chromium by Google researchers
2026-07-29: patched: Fixed in version 151.0.7922.72
2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.