CVE-2026-17920: Google Chrome V8 Use After Free Vulnerability

CVE-2026-17920 Overview

CVE-2026-17920 is a use-after-free vulnerability [CWE-416] in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. An attacker who convinces a user to install a malicious Chrome extension can trigger the condition to execute arbitrary code inside the browser sandbox. Google classifies the Chromium security severity as Low because exploitation requires the victim to install an attacker-controlled extension, and the resulting code execution is confined to the renderer sandbox. Google addressed the issue in the Stable channel update for desktop.

Critical Impact
A crafted Chrome Extension can trigger a V8 use-after-free that leads to arbitrary code execution inside the Chrome sandbox on unpatched installations.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
V8 JavaScript engine as shipped with the affected Chrome builds
Chromium-based browsers embedding the vulnerable V8 release

Discovery Timeline

2026-07-30 - CVE-2026-17920 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17920

Vulnerability Analysis

The vulnerability is a use-after-free condition inside V8, the JavaScript and WebAssembly engine embedded in Chrome. Use-after-free flaws occur when a program continues to reference memory after that memory has been released. In V8, such conditions typically arise when object lifetimes tracked by the garbage collector are not correctly synchronized with pointers held by compiled code, inline caches, or extension APIs. An attacker who can reach the affected code path can coerce V8 into operating on a dangling reference, allowing controlled reuse of the freed allocation.

Once the freed object is reclaimed with attacker-influenced data, V8 may dereference forged type metadata or function pointers. This turns memory corruption into control-flow hijack inside the renderer process. Because the entry point is a Chrome Extension, the attacker also benefits from the elevated JavaScript privileges granted to extension contexts.

Root Cause

The root cause is improper object lifetime management inside V8 [CWE-416]. Chromium issue #513413942 tracks the specific defect. Google resolved the bug in Chrome 151.0.7922.72 on the Stable channel.

Attack Vector

Exploitation requires social engineering. The attacker must convince the target to install a malicious Chrome Extension. Once installed, the extension executes JavaScript that triggers the vulnerable V8 path and gains arbitrary code execution within the sandboxed renderer. A sandbox escape would require chaining an additional vulnerability. See the Chromium Issue Tracker #513413942 and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2026-17920

Indicators of Compromise

Installation of Chrome extensions from outside the official Chrome Web Store, especially through sideloading or developer mode
Chrome renderer processes crashing with access violations or exhibiting anomalous child process creation shortly after extension installation
Extension packages requesting broad host permissions or scripting and debugger APIs without a clear business need

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist
Alert on Chrome versions below 151.0.7922.72 reported by endpoint telemetry or browser management consoles
Monitor for unexpected writes to the Chrome Extensions and Preferences directories in user profiles

Monitoring Recommendations

Ingest Chrome enterprise reporting events to track extension installs, updates, and version data centrally
Correlate renderer crash telemetry with recent extension changes to surface potential exploitation attempts
Review Chrome policy compliance for ExtensionInstallBlocklist and ExtensionInstallAllowlist on a recurring basis

How to Mitigate CVE-2026-17920

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
Restart Chrome after the update so the patched V8 binary is loaded into every renderer
Audit installed extensions and remove any that are unrecognized, sideloaded, or unnecessary

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update. The vendor fix is included in Chrome 151.0.7922.72. Chromium-based browsers should apply the equivalent V8 update once their upstream merges the patch.

Workarounds

Enforce an extension allowlist through Chrome Enterprise policy to block installation of untrusted extensions
Restrict extension sources to the Chrome Web Store and disable developer mode for standard users
Deliver targeted user awareness on the risks of installing extensions from untrusted publishers or direct download links

bash

# Chrome Enterprise policy example: allowlist-only extensions (Linux managed policy)
cat <<'EOF' > /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}
EOF