Google Chrome CVE-2026-17749

Exploitation requires the victim to install a malicious, attacker-crafted Chrome extension - this user-interaction step (UI:R) is the primary limiting factor and is not a default condition. The malicious extension must then supply crafted input that Chrome's Extensions component fails to validate, triggering the sandbox escape. Limiting factors: the target must run a Chrome desktop build below 151.0.7922.72, must be persuaded to install the extension (blocked outright in environments enforcing an extension allowlist or Web Store-only policy), and no authentication to any service is needed but attacker code must execute inside the browser via the installed extension. There is no remote unauthenticated drive-by path against a default install without the extension-installation action.

The signals conflict sharply and should temper the headline number. NVD's 9.6 is driven by S:C plus C:H/I:H/A:H and PR:N, but PR:N is technically true only because Chrome imposes no in-app privilege - real exploitation still requires the victim to install a malicious extension (UI:R), a substantial social-engineering barrier. Chromium's own rating is Medium, EPSS is very low at 0.13% (3rd percentile), and CISA SSVC lists Exploitation: none and Automatable: no, all pointing to low likelihood of opportunistic, at-scale attacks. The one signal that agrees with high severity is SSVC Technical Impact: total, consistent with a full sandbox escape. Net: this is a legitimately serious code-execution-class bug but not an urgent internet-wide emergency - the 9.6 overstates real-world risk relative to the required user action and absence of exploitation. Patch on normal Chrome auto-update cadence rather than as an emergency out-of-band action, unless extension governance is weak in your environment.

An attacker publishes or distributes a seemingly benign browser extension and, through phishing or a lure site, convinces a target to install it; once running, the extension sends crafted, improperly validated input across an extension API/IPC boundary to escape the sandbox and gain execution with the browser process's privileges. No public POC has been identified, and the required extension-install step makes this best suited to targeted rather than mass exploitation.