EUVD-2026-50874
GHSA-c2p8-6273-hp5x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious extension
-
DeliveryExtension loads crafted JS in V8
-
ExploitTrigger type confusion in engine
-
ExecutionCorrupt object type interpretation
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to install and run an attacker-supplied malicious Chrome extension - that installed, crafted extension IS the delivery condition per the description. The resulting code execution is confined to the renderer sandbox, so without an additional sandbox-escape the attacker does not gain host-level control. Limiting factors: mandatory user interaction (UI:R) to accept extension installation, high attack complexity (AC:H) implying a non-trivial and possibly non-deterministic exploit primitive, and applicability only to Chrome builds prior to 151.0.7922.72. No authentication on a target service is needed (PR:N), but the social-engineering and non-default step of installing an untrusted extension is the practical barrier. |
| Impact | The signals are consistent and point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5 High) reflects total impact on the affected process but with high attack complexity and required user interaction. CISA's SSVC framework independently corroborates lower operational urgency: Exploitation = none, Automatable = no, Technical Impact = total - the flaw is powerful if triggered but not currently exploited or scalable. It is NOT on the CISA KEV list and no public exploit is identified, so this is not active-exploitation-driven risk. The key caveat is that execution is explicitly contained 'inside a sandbox' and requires the victim to first install a malicious extension - a substantial social-engineering barrier - so real-world risk without a chained sandbox-escape is materially lower than the 7.5 score alone suggests, consistent with Chromium's own 'Low' severity rating. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a malicious Chrome extension and social-engineers a victim into installing it; once loaded, the extension's crafted JavaScript triggers the V8 type confusion and executes arbitrary code within the renderer sandbox. Given AC:H and UI:R, the attack is not drive-by and requires deliberate victim action plus a reliable exploit primitive; no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) is possible when a user is convinced to install a malicious Chrome extension that triggers a type-confusion condition (CWE-843), letting the attacker run code inside the renderer sandbox. Google has shipped a fixed stable build, and while the Chromium team rated the security severity as Low, the CVSS base score is 7.5 due to full confidentiality, integrity, and availability impact on the compromised process. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation as 'none.'
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); this is the primary and complete fix. Because Chrome auto-updates, ensure clients are allowed to fetch and apply updates and restart the browser to load the new binary. As a compensating control until patching completes, restrict extension installation through enterprise policy (ExtensionInstallBlocklist set to '*' with an ExtensionInstallAllowlist of vetted IDs, or ExtensionInstallForcelist for managed deployments) to remove the required attack precondition - the trade-off is reduced user flexibility in installing extensions. Auditing and removing unknown or sideloaded extensions further reduces exposure. Reference: NVD detail https://nvd.nist.gov/vuln/detail/CVE-2026-17948.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and Chromium-derived browsers. The root cause is CWE-843 Type Confusion, where the engine treats a memory object as one type when it is actually another, allowing an attacker-controlled object layout to be misinterpreted and leveraged for out-of-bounds reads/writes and ultimately code execution. The affected component is reached through a crafted Chrome Extension, meaning the malicious JavaScript executes with the privileges of an installed extension's renderer context. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote via web content but AC:H and UI:R because the victim must install a malicious extension; impact is total within the sandboxed renderer, so S:U and C/I/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Executive ViewAI
Google Chrome users face arbitrary code execution risk through malicious extension installations targeting a type-confusion vulnerability in the V8 JavaScript engine. While no active exploitation has been confirmed, compromised systems could allow attackers to steal data or install malware within the browser sandbox. Immediate patching to Chrome 151.0.7922.72+ is required to eliminate the attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB