What is the CVSS score of CVE-2026-17948?

CVE-2026-17948 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17948?

Google Chrome users face arbitrary code execution risk through malicious extension installations targeting a type-confusion vulnerability in the V8 JavaScript engine.. A patch is available.

How to fix or mitigate CVE-2026-17948?

Within 24 hours, identify all Chrome installations across your organization and notify users of the available patch. Within 7 days, deploy Chrome 151.0.7922.72 or later through your desktop management tools and auto-update mechanisms; prioritize systems where users frequently install browser extensions. Within 30 days, verify patch deployment across 95%+ of Chrome instances and implement extension management policies to restrict installation of untrusted extensions.

Google Chrome CVE-2026-17948

EUVD-2026-50874 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-c2p8-6273-hp5x

RCE Google Memory Corruption

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote via web content but AC:H and UI:R because the victim must install a malicious extension; impact is total within the sandboxed renderer, so S:U and C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.5

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) is possible when a user is convinced to install a malicious Chrome extension that triggers a type-confusion condition (CWE-843), letting the attacker run code inside the renderer sandbox. Google has shipped a fixed stable build, and while the Chromium team rated the security severity as Low, the CVSS base score is 7.5 due to full confidentiality, integrity, and availability impact on the compromised process. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation as 'none.'

Technical ContextAI

The flaw resides in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and Chromium-derived browsers. The root cause is CWE-843 Type Confusion, where the engine treats a memory object as one type when it is actually another, allowing an attacker-controlled object layout to be misinterpreted and leveraged for out-of-bounds reads/writes and ultimately code execution. The affected component is reached through a crafted Chrome Extension, meaning the malicious JavaScript executes with the privileges of an installed extension's renderer context. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); this is the primary and complete fix. Because Chrome auto-updates, ensure clients are allowed to fetch and apply updates and restart the browser to load the new binary. As a compensating control until patching completes, restrict extension installation through enterprise policy (ExtensionInstallBlocklist set to '*' with an ExtensionInstallAllowlist of vetted IDs, or ExtensionInstallForcelist for managed deployments) to remove the required attack precondition - the trade-off is reduced user flexibility in installing extensions. Auditing and removing unknown or sideloaded extensions further reduces exposure. Reference: NVD detail https://nvd.nist.gov/vuln/detail/CVE-2026-17948.