CVE-2026-17995 in Chrome
Summary
by MITRE • 07/30/2026
Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a classic out-of-bounds memory read flaw that existed within the Dawn JavaScript engine component of Google Chrome versions prior to 151.0.7922.72. The issue stems from inadequate input validation and boundary checking mechanisms within the engine's memory management subsystem, specifically when processing crafted HTML content. Such vulnerabilities fall under the CWE-129 classification for Improper Validation of Array Index, which directly relates to the fundamental flaw where the system fails to properly validate array indices before accessing memory locations.
The technical exploitation of this vulnerability occurs when a remote attacker crafts a malicious HTML page designed to trigger specific conditions within the Dawn engine's execution path. This typically involves manipulating JavaScript objects or arrays in ways that cause the engine to access memory locations beyond allocated boundaries. The Chromium security severity classification of Low indicates the vulnerability's potential impact, though it should not be underestimated as out-of-bounds reads can often serve as precursors to more severe exploits including information disclosure or privilege escalation scenarios.
The operational impact of this vulnerability extends beyond simple data corruption or crashes, as it creates potential entry points for attackers to gather sensitive information from memory segments. When such an out-of-bounds read occurs, it may expose stack contents, heap data, or other sensitive information that could be leveraged in subsequent attacks. The Dawn engine's role within Chrome's architecture means this vulnerability affects the browser's JavaScript execution environment, potentially allowing attackers to extract confidential data or system information that could aid in further exploitation attempts.
Mitigation strategies for this vulnerability primarily focus on updating to the patched version of Google Chrome 151.0.7922.72 or later, which includes proper boundary checking mechanisms and input validation routines. System administrators should prioritize immediate deployment of the security update across all affected systems while implementing additional browser hardening measures such as sandboxing configurations and content security policies. The ATT&CK framework's T1059.007 technique for Command and Scripting Interpreter: JavaScript highlights how such vulnerabilities can be exploited through malicious script delivery, emphasizing the need for comprehensive defensive measures including web application firewalls and regular security assessments to prevent exploitation of similar memory corruption flaws in other browser components or web applications.