What is the CVSS score of CVE-2026-17778?

CVE-2026-17778 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17778?

Google Chrome versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the Extensions component that allows remote code execution within the browser sandbox when users load a…. A patch is available.

How to fix or mitigate CVE-2026-17778?

Within 24 hours, issue urgent communication to all staff directing immediate Chrome updates and prohibiting loading untrusted extensions; coordinate with IT security to identify any non-standard or suspicious extensions currently deployed. Within 7 days, ensure all Chrome instances are updated to version 151.0.7922.72 or later via automated patch management or manual update prompts, with verification through endpoint telemetry. Within 30 days, conduct full audit of all installed extensions across affected systems, disable any unsigned or uncommonly-used extensions pending security review, and implement configuration policies to restrict extension installation to an organization-approved allowlist.

Google Chrome CVE-2026-17778

EUVD-2026-50727 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-7v9m-6384-f4jq

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted extension triggers the bug with low complexity and no prior privileges but requires the user to load it (UI:R); impact is high yet scope-unchanged since code stays sandboxed (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:26 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's Extensions subsystem - the browser component that loads, manages, and executes WebExtension code (manifest-based extensions with their background service workers, content scripts, and extension APIs). A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to reclaim the freed allocation and hijack control flow. Per the affected CPE (cpe:2.3:a:google:chrome:*), this affects the desktop Chrome browser (Chromium engine) on all platforms served by the stable channel update; because the description specifies code executes 'inside a sandbox,' the corruption is triggered within the renderer/extension process boundary rather than the privileged browser process.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Channel Update for Desktop (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome auto-updates, so ensure clients relaunch the browser to apply the fix and verify the running version under chrome://settings/help. As a compensating control until patched, restrict extension installation through enterprise policy (ExtensionInstallBlocklist set to '*' with an ExtensionInstallAllowlist of vetted IDs, or ExtensionInstallForcelist for managed-only extensions) so users cannot load untrusted or crafted extensions - the trade-off is reduced user flexibility and possible breakage of legitimately-used add-ons. Users of Chromium-based browsers (Edge, Brave, Opera) should apply their vendor's build incorporating Chromium 151.0.7922.72. No sandbox-escape chain is required by this specific CVE, so keeping site isolation and the extension sandbox enabled (defaults) preserves the containment that limits impact.