What is the CVSS score of CVE-2026-17989?

CVE-2026-17989 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17989?

A remote code execution vulnerability in Google Chrome's V8 JavaScript engine (CVE-2026-17989) affects all desktop versions prior to 151.0.7922.72, with no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-17989?

Within 24 hours, conduct an inventory of all Chrome desktop deployments in the organization and notify users of the vulnerability, advising immediate update or restricted browsing pending patching. Within 7 days, deploy Google Chrome version 151.0.7922.72 or later to development and QA environments to test compatibility with business-critical web applications before enterprise-wide rollout. Within 30 days, enforce mandatory upgrade to Google Chrome version 151.0.7922.72 or later across all desktop endpoints via endpoint management tools, verify completion through audit reports, and confirm all instances meet the minimum version requirement.

Google Chrome CVE-2026-17989

EUVD-2026-50915 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-vc8g-6cm2-mwx5

RCE Google Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the user to visit it (UI:R); scope stays Unchanged because code runs confined within the renderer sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Arbitrary code execution in Google Chrome's V8 JavaScript engine allows a remote attacker to run code inside the renderer sandbox when a victim visits a crafted HTML page, affecting all desktop builds prior to 151.0.7922.72. The flaw is a CWE-843 type confusion in V8 and carries a CVSS 8.8 due to network reach and high CIA impact, though execution is confined to the sandbox and Chromium rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Technical ContextAI

The vulnerability lives in V8, the just-in-time-compiling JavaScript/WebAssembly engine that powers Chrome and every Chromium-derived browser. CWE-843 (Type Confusion) occurs when the engine allocates or interprets an object as one type while it is actually another, typically through optimizer or garbage-collector edge cases that let attacker-controlled JavaScript violate V8's internal type assumptions. This yields arbitrary read/write primitives in the renderer's address space and ultimately code execution within that process. The single CPE provided, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirms the affected component is the Chrome desktop application itself; because the same V8 code is shared, downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) are typically affected until they rebase on the fixed V8.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; Chrome normally auto-updates, so ensure the browser has been fully relaunched to apply the new binary and verify the version under chrome://settings/help. In managed environments, push the update through your existing browser management (Google Admin Console policy, SCCM/Intune, or package repo) and force a restart to complete installation. If patching must be delayed, the practical compensating control is to keep Chrome's site isolation and sandbox enabled (default) and restrict browsing to trusted sites, since exploitation requires the user to load a malicious HTML page; note this only reduces exposure and does not remove the flaw. Users of other Chromium-based browsers should apply their vendor's corresponding V8 update once released.