What is the CVSS score of CVE-2026-17979?

CVE-2026-17979 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17979?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in the V8 JavaScript engine that enables attackers to execute code within the browser's renderer sandbox by…. A patch is available.

How to fix or mitigate CVE-2026-17979?

Within 24 hours, inventory and assess Chrome deployment scope across the organization. Within 7 days, deploy Chrome 151.0.7922.72 or later via your browser update mechanism to all affected systems; prioritize client-facing and development machines. Within 30 days, verify 100% deployment completion and document remediation in your vulnerability management system, noting this as resolved once patch adoption reaches full compliance.

Google Chrome CVE-2026-17979

EUVD-2026-50905 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-h8h7-r9hg-ph8f

RCE Google Race Condition Red Hat Suse

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Crafted page is network-reachable (AV:N) but needs a victim visit (UI:R) and winning a race (AC:H); code runs in the renderer sandbox so scope is unchanged (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.5

DescriptionCVE.org

Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.

Technical ContextAI

The flaw lives in V8, the JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition): concurrently executing code paths access a shared resource without adequate locking, letting an attacker manipulate memory state during the window between check and use to corrupt engine internals and gain code execution. Per the CPE data (cpe:2.3:a:google:chrome), the affected component is the desktop Chrome application; because V8 is shared upstream, other Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps) likely inherit the same defect until they rebase on the fixed V8. Crucially, the described impact is code execution 'inside a sandbox,' meaning the compromise is contained to the renderer process and CVSS scope is Unchanged (S:U) - a separate sandbox-escape bug would be required to reach the host OS.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; the fix is described in Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, most endpoints will receive the fix on next relaunch, so the primary compensating control is to force a browser restart across the fleet rather than waiting for background updates, and to verify the installed version via chrome://settings/help. Users of other Chromium-based browsers should apply their vendor's corresponding update once it rebases on the patched V8. As an interim measure for high-risk users, restricting untrusted-site browsing or enabling site isolation reduces exposure, but these do not fully substitute for the patch and carry usability trade-offs.