What is the CVSS score of CVE-2026-17920?

CVE-2026-17920 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17920?

Google Chrome versions prior to 151.0.7922.72 contain a memory-corruption vulnerability in the V8 JavaScript engine that could enable arbitrary code execution within the browser sandbox.. A patch is available.

How to fix or mitigate CVE-2026-17920?

Within 24 hours, notify all users of the available Chrome security update (version 151.0.7922.72 or later from the July 2026 Stable channel) and advise against installing unverified Chrome extensions. Within 7 days, deploy Chrome 151.0.7922.72 through your standard software distribution mechanism to all systems running affected versions. Within 30 days, verify deployment completion via endpoint telemetry and confirm no systems remain on versions prior to 151.0.7922.72.

Google Chrome CVE-2026-17920

EUVD-2026-50669 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-q3m4-5gjc-6gmv

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.3 MEDIUM

Network-reachable and low-complexity once the user installs the extension (UI:R, PR:N), but code stays inside the renderer sandbox with no escape, so impacts are Low rather than High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:25 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine affects all desktop versions prior to 151.0.7922.72, triggered when a victim installs a crafted malicious Chrome extension that exploits a use-after-free memory-corruption bug. Google fixed this in the July 2026 Stable channel update, and no public exploit identified at time of analysis; EPSS is low at 0.13% (3rd percentile), consistent with Chromium's own 'Low' security-severity rating despite the CVSS base score of 8.8.

Technical ContextAI

The flaw is a CWE-416 use-after-free in V8, the C++ JavaScript/WebAssembly engine embedded in Chromium-based browsers. Use-after-free occurs when code keeps referencing heap memory after it has been freed, letting an attacker groom the heap and reclaim the stale allocation with attacker-controlled data to hijack control flow. Here the trigger surface is the Chrome Extension APIs feeding attacker-controlled script into V8; the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome application across versions below the fix. Execution is confined to the sandboxed renderer process, so this yields a code-execution primitive inside the sandbox rather than a full sandbox escape to the host.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72 (or later) on the Stable desktop channel - upgrade via Chrome's built-in updater (Settings > About Chrome) and relaunch to apply, per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires installing a malicious extension, the primary compensating control is to restrict extension installation via enterprise policy: set ExtensionInstallBlocklist to '*' with an ExtensionInstallAllowlist of vetted IDs, or pin approved add-ons with ExtensionInstallForcelist - the trade-off is that users lose self-install ability and helpdesk must curate the allowlist. Auditing and removing unknown or side-loaded extensions reduces exposure until the update lands. Chromium-based browsers built on the same V8 should be updated once their vendors ship the fixed engine. Bug tracker reference: https://issues.chromium.org/issues/513413942.