What is the CVSS score of CVE-2026-17898?

CVE-2026-17898 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17898?

Google Chrome versions before 151.0.7922.72 contain a code execution vulnerability affecting all desktop users; no public exploit identified at time of analysis, and exploitation requires users to…. A patch is available.

How to fix or mitigate CVE-2026-17898?

Within 24 hours, alert users to avoid installing untrusted Chrome extensions and verify any installed extensions through the official Chrome Web Store. Within 7 days, deploy Chrome version 151.0.7922.72 or later organization-wide across all Windows, macOS, and Linux endpoints via your endpoint management solution. Within 30 days, conduct security awareness training on extension risks and audit active extensions across your fleet to identify and remove suspicious or unauthorized installations.

Google Chrome CVE-2026-17898

EUVD-2026-50647 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-3928-85xc-vfvp

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.0 MEDIUM

Requires social-engineered malicious extension install (UI:R, AC:H); code stays within the sandbox so impacts are Low, not High, consistent with Chromium's Low rating.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:29 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome's DevTools component affects all desktop builds prior to 151.0.7922.72, where a use-after-free (CWE-416) can be triggered by a crafted Chrome Extension. An attacker must first convince the victim to install a malicious extension, after which they can run code confined to the browser sandbox. Chromium rated this Low severity; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.13%, 3rd percentile).

Technical ContextAI

The flaw resides in Chrome DevTools, the built-in developer tooling exposed to extensions via the debugger/DevTools protocol APIs. The root cause is a use-after-free (CWE-416): a memory object tied to DevTools is freed while a reference to it remains live, and a crafted extension can drive DevTools into re-accessing the dangling pointer to corrupt memory and hijack control flow. Per the CPE (cpe:2.3:a:google:chrome:*) this affects the Chrome application across platforms; exploitation is scoped to the renderer/DevTools sandbox rather than the privileged browser process, which is why arbitrary code runs 'inside a sandbox' rather than at OS privilege.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel (Chrome auto-updates on relaunch; force it under Settings > About Google Chrome and restart), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation depends on the victim installing a malicious extension, the most effective compensating control until patching completes is to restrict extension installation - enforce an enterprise extension allowlist/blocklist via the ExtensionInstallAllowlist/ExtensionInstallBlocklist group policies and disable developer-mode extension loading; the trade-off is reduced user flexibility in adding extensions. Auditing and removing untrusted installed extensions further reduces exposure with minimal operational impact.