What is the CVSS score of CVE-2026-17786?

CVE-2026-17786 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17786?

Google Chrome versions prior to 151.0.7922.72 contain a privilege escalation vulnerability (CVE-2026-17786, CVSS 8.8) in the DevTools component that allows attackers who trick users into installing…. A patch is available.

How to fix or mitigate CVE-2026-17786?

Within 24 hours, alert all users not to install Chrome extensions from untrusted sources and instruct them to audit their currently installed extensions for suspicious or unfamiliar items. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all managed devices using your standard patch management process and verify completion. Within 30 days, implement organization-wide policies to restrict Chrome extension installation to pre-approved sources only, establish an approved extensions allowlist, and enable monitoring for unauthorized extension activity.

Google Chrome CVE-2026-17786

EUVD-2026-50735 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-w6wx-r223-7v5f

Privilege Escalation Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted extension (AV:N/AC:L/PR:N) but requires the user to install the malicious extension (UI:R); privilege escalation yields high C/I/A within the browser (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.9 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:26 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets an attacker who convinces a user to install a malicious extension escape the normal extension privilege boundary via a crafted Chrome Extension. Rooted in insufficient validation of untrusted input (CWE-20), the flaw carries a CVSS 8.8 rating reflecting high confidentiality, integrity, and availability impact once the extension is installed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome's ubiquity makes patch urgency high.

Technical ContextAI

The vulnerability lives in Chrome DevTools, the built-in developer/debugging surface that exposes powerful inspection and control APIs (DOM, network, JavaScript execution, and the debugger/devtools extension APIs). Extensions can request access to these APIs, and DevTools is a historically privileged bridge between renderer-level content and browser-level capabilities. CWE-20 (Improper Input Validation) here means DevTools does not sufficiently validate untrusted input supplied through a crafted extension, allowing that extension to perform actions beyond its intended privilege scope. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected component is the Chrome application itself (desktop stable channel), with the fix landing in 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the stable-channel desktop update, then restart the browser to apply it (Chrome auto-updates but the restart is required to complete installation) - see https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation hinges on installation of a malicious extension, the highest-value compensating control until patching completes is restricting extension installation: enforce an enterprise extension allowlist/blocklist through Chrome policy (ExtensionInstallAllowlist/ExtensionInstallBlocklist) so users can only install vetted extensions - the trade-off is added admin overhead and possible friction for users who rely on unlisted extensions. As a secondary measure, disable installation of extensions from outside the Chrome Web Store and audit currently installed extensions for unexpected DevTools/debugger permissions.