What is the CVSS score of CVE-2026-17952?

CVE-2026-17952 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17952?

Google Chrome versions prior to 151.0.7922.72 contain a code execution vulnerability in the V8 JavaScript engine that can be exploited through malicious browser extensions.. A patch is available.

How to fix or mitigate CVE-2026-17952?

Within 24 hours, notify all Chrome users of the available security update and reinforce policy against installing extensions from untrusted sources. Within 7 days, deploy Chrome 151.0.7922.72 or later across all desktop systems using your standard patch management process, and audit existing user extensions for any unauthorized or suspicious installations. Within 30 days, verify complete update coverage across your Chrome deployment and conduct follow-up security awareness training on extension risks.

Google Chrome CVE-2026-17952

EUVD-2026-50878 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-4cwj-qj59-c6vc

Privilege Escalation RCE Google Red Hat Suse

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires convincing a user to install a malicious extension (UI:R, AC:H, PR:N); code runs within the sandbox (S:U) with total impact on that context, so C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.5

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

AnalysisAI

Sandbox-constrained arbitrary code execution in Google Chrome's V8 JavaScript engine affects all desktop builds prior to 151.0.7922.72, where a crafted Chrome extension abuses an inappropriate V8 implementation to run attacker code inside the renderer sandbox. Exploitation requires convincing a user to install a malicious extension, and Google internally rated the Chromium security severity as Low. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none'.

Technical ContextAI

The flaw lives in V8, Chrome's high-performance JavaScript and WebAssembly engine, and is classified as CWE-269 (Improper Privilege Management). Rather than a memory-corruption bug, this is an 'inappropriate implementation' - a logic/privilege-boundary defect where the extension execution context reaches capabilities it should not, allowing a crafted extension to execute arbitrary code within V8. Critically, the resulting code runs inside the Chrome sandbox, so the boundary crossed is the extension/renderer privilege model, not an OS-level sandbox escape. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, i.e. the Chrome desktop application across affected versions.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - update to this stable-channel build or later, which for most users happens automatically via Chrome's background updater (verify at chrome://settings/help and relaunch). The advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation depends entirely on the user installing a malicious extension, the most effective compensating control is to restrict extension installation: in managed environments use the ExtensionInstallBlocklist/ExtensionInstallAllowlist enterprise policies to permit only vetted Chrome Web Store extensions, trading some user flexibility for a smaller attack surface. Users should remove unknown or untrusted extensions and avoid side-loading unpacked extensions until updated.