CVE-2026-17665: Google Chrome V8 Use-After-Free Flaw

CVE-2026-17665 Overview

CVE-2026-17665 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. Google rates the Chromium security severity as High. The flaw is tracked under CWE-416 and was addressed in the Chrome Stable channel update for desktop.

Critical Impact
Remote code execution inside the renderer sandbox through a single crafted web page, enabling attacker-controlled JavaScript to run in the context of the victim's browser tab.

Affected Products

Google Chrome for desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable V8 builds
Downstream distributions bundling the pre-patch V8 engine

Discovery Timeline

2026-07-30 - CVE-2026-17665 published to NVD
2026-07-30 - Last updated in NVD database
2026-07 - Google releases Chrome Stable channel update addressing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-17665

Vulnerability Analysis

The vulnerability is a use-after-free condition in V8, the JavaScript and WebAssembly engine that Chrome ships as part of the renderer process. When V8 releases an object, a lingering reference can still be dereferenced during subsequent script execution. An attacker who controls the JavaScript running in the tab can manipulate the freed memory, place an attacker-shaped object in its slot, and trigger execution against corrupted state. The result is arbitrary code execution inside the renderer sandbox. The Chromium project has assigned it High severity and tracks the fix in the Chromium Issue Tracker Post.

Root Cause

The root cause is improper lifetime management inside V8 [CWE-416]. A specific object or handle is freed while another code path retains a pointer to it. Later access reuses that stale pointer, allowing type confusion or controlled write primitives against the reallocated memory.

Attack Vector

Exploitation requires a victim to visit or be redirected to attacker-controlled content. The delivery vehicle is a crafted HTML page containing JavaScript that shapes the V8 heap, triggers the free, and reclaims the slot. Execution is confined to the renderer sandbox, which means an attacker still needs a second sandbox escape vulnerability to achieve full host compromise. The vulnerability is exploitable without authentication and without user interaction beyond navigation.

No public proof-of-concept has been published. Refer to the Chromium Issue Tracker Post for restricted technical details once Google unrestricts the ticket.

Detection Methods for CVE-2026-17665

Indicators of Compromise

Chrome renderer process crashes with signatures referencing V8 heap objects or v8::internal frames
Endpoints running Chrome builds older than 151.0.7922.72 after the patch release date
Outbound connections from renderer processes to newly registered or low-reputation domains hosting HTML/JavaScript payloads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Correlate browser crash telemetry with subsequent process anomalies such as unexpected child processes spawned by chrome.exe
Apply web-proxy and DNS logging to identify user navigation to suspicious or newly observed domains preceding renderer crashes

Monitoring Recommendations

Ingest browser update posture and crash reports into the SIEM for continuous version drift detection
Alert on unsigned or unexpected modules loaded into the Chrome process tree
Monitor for renderer sandbox escape indicators such as token manipulation or lateral file-system access from Chrome child processes

How to Mitigate CVE-2026-17665

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart browser sessions after deployment to ensure the patched V8 binary is loaded
Audit Chromium-based third-party browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding V8 updates

Patch Information

Google addressed the flaw in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. The fix is included in Chrome 151.0.7922.72 for desktop platforms. Administrators should confirm auto-update is enabled or push the update through enterprise policy.

Workarounds

Enforce Chrome enterprise policies that disable JavaScript on untrusted sites until patching completes
Restrict browsing to allow-listed domains for high-risk users through web proxy or DNS filtering
Use site isolation and the strictest available sandbox settings to limit the blast radius of renderer compromise

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS/Linux
google-chrome --version