What is the CVSS score of CVE-2026-17658?

CVE-2026-17658 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-17658?

A remote code execution vulnerability in Google Chrome's V8 engine (CVE-2026-17658) allows attackers to execute arbitrary code on users' systems through malicious webpages; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-17658?

Within 24 hours: Identify and inventory all Chrome-using endpoints and verify current versions against the vulnerable pre-151.0.7922.72 releases. Within 7 days: Deploy Chrome version 151.0.7922.72 or later across all devices through your standard patch management process, prioritizing systems with high internet exposure. Within 30 days: Verify complete deployment via endpoint audits and telemetry, and review browser process monitoring to detect post-patch exploitation attempts.

Google Chrome CVE-2026-17658

EUVD-2026-50784 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-qp73-3238-xr3r

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered malicious page needs no auth (PR:N) but requires the victim to open it (UI:R); code runs in the renderer sandbox so scope unchanged (S:U) with full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.

Technical ContextAI

The vulnerability resides in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. Use-after-free (CWE-416) occurs when the engine continues to reference a heap object after it has been freed - in V8 this is typically triggered by JavaScript that manipulates object lifetimes (e.g., during garbage collection, optimization/deoptimization, or type transitions) so that a dangling pointer is later dereferenced. An attacker who controls the freed-then-reused memory can groom the heap to place attacker-chosen data where the stale pointer points, yielding memory corruption that can be steered into control-flow hijack. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; the same code is present in other Chromium-based browsers, though only Chrome is named here.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; verify the exact fixed build for your platform in Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, force the update by pushing the new package or setting policy to auto-update, then relaunch the browser so the new V8 binary is loaded (a restart is required for the fix to take effect). Until updates roll out, reduce exposure by restricting browsing to trusted sites, enabling a stricter Site Isolation posture, and considering enterprise policies that limit untrusted JavaScript execution - trade-off being reduced usability on legitimate sites; disabling JavaScript entirely would block the vector but breaks most modern web applications and is generally impractical. Users of other Chromium-based browsers should apply their vendor's corresponding update once it incorporates the fixed V8.