What is the CVSS score of CVE-2026-17725?

CVE-2026-17725 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-17725?

A high-severity flaw in Chrome's V8 JavaScript engine (versions before 151.0.7922.72) enables remote code execution when users visit malicious websites, potentially giving attackers access to…. A patch is available.

How to fix or mitigate CVE-2026-17725?

Within 24 hours, inventory Chrome deployments across the organization and prepare automated patching. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all systems using your endpoint management platform, with priority on systems handling sensitive data. Within 30 days, verify 100% patch compliance through automated scanning and implement mandatory auto-update enforcement to prevent regression.

Google Chrome CVE-2026-17725

EUVD-2026-50851 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-mh8j-cw3w-4f8w

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N/AC:L/PR:N) needs the user to visit it (UI:R); renderer-sandboxed RCE keeps scope unchanged (S:U) with full C/I/A impact on that process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:23 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.

Technical ContextAI

The vulnerability is a CWE-843 Type Confusion in V8, the C++ JavaScript and WebAssembly engine embedded in Chrome and all Chromium-derived browsers. Type confusion occurs when the engine's optimizing compiler or runtime treats a memory object as a different type than it actually is, letting attacker-controlled JavaScript manipulate object shapes so a subsequent operation reads or writes memory using an incorrect type layout. This yields a powerful memory corruption primitive that is commonly escalated to arbitrary read/write and ultimately code execution. The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected component is the Chrome application itself; because V8 is shared, other Chromium browsers (Edge, Brave, Opera, Electron apps) are typically affected by the same class of bug even though only Google Chrome is enumerated here.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the built-in updater (Chrome menu > Help > About Google Chrome, then relaunch) and confirm the fixed build is running, as detailed in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through enterprise policy/MDM and force a browser restart to apply it. If immediate patching is not possible, reduce exposure by enabling Chrome's site isolation and 'Enhanced' Safe Browsing, restricting browsing of untrusted sites, and considering JavaScript restrictions on high-risk profiles via enterprise policy - with the trade-off that disabling or limiting JavaScript breaks many legitimate web applications and is disruptive as a broad control.