PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17920 Google CVE debrief

CVE-2026-17920 is a use-after-free vulnerability in V8 in Google Chrome prior to 151.0.7922.72. An attacker who convinces a user to install a malicious extension can execute arbitrary code inside a sandbox via a crafted Chrome Extension. The CVSS score is 8.8, indicating a high severity vulnerability. This vulnerability affects Google Chrome deployments, especially those allowing users to install extensions from outside the Chrome Web Store. Defenders should assess exposure and prioritize patching or mitigating this vulnerability. The vulnerability was reported by an external researcher and is described in the Chromium security severity as Low.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing Google Chrome deployments, especially those who allow users to install extensions from outside the Chrome Web Store, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-17920 is a high-severity vulnerability in Google Chrome that allows an attacker to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Defenders should prioritize patching or mitigating this vulnerability, especially for users who install extensions from outside the Chrome Web Store.

  • Potential for arbitrary code execution inside a sandbox
  • Possible bypass of Chrome's security features
  • Requires verification of affected versions and remediation status
  • May require monitoring for suspicious extension activity

Technical summary

The vulnerability is a use-after-free in V8, a JavaScript engine used by Google Chrome. An attacker can exploit this vulnerability by convincing a user to install a malicious extension, which can execute arbitrary code inside a sandbox. The vulnerability has a CVSS score of 8.8, indicating high severity. It is recommended to patch Google Chrome to version 151.0.7922.72 or later and implement a deny-list for installing extensions from outside the Chrome Web Store.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for users who install extensions from outside the Chrome Web Store.

Recommended defensive actions

  • Patch Google Chrome to version 151.0.7922.72 or later
  • Implement a deny-list for installing extensions from outside the Chrome Web Store
  • Monitor for suspicious extension installations

Evidence notes

The vulnerability was reported by an external researcher and is described in the Chromium security severity as Low. However, the CVSS score is 8.8, indicating a high severity vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17920 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17920

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17920 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17920

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.