CVE-2026-17952: Google Chrome V8 RCE Vulnerability

CVE-2026-17952 Overview

CVE-2026-17952 affects Google Chrome's V8 JavaScript engine in versions prior to 151.0.7922.72. The flaw stems from an inappropriate implementation in V8 that an attacker can leverage through a crafted Chrome Extension. Successful exploitation requires convincing a user to install a malicious extension. Once installed, the extension can execute arbitrary code inside the Chrome sandbox. Google's Chromium team rated the security severity as Low, reflecting the sandboxed execution scope and the user-interaction requirement.

Critical Impact
Arbitrary code execution inside the Chrome sandbox via a malicious extension abusing a V8 implementation flaw.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers incorporating vulnerable V8 builds
Desktop Chrome Stable channel across supported operating systems

Discovery Timeline

2026-07-30 - CVE-2026-17952 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17952

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine embedded in Chrome. According to Google's advisory, the issue is an inappropriate implementation rather than a memory corruption bug. The condition is reachable only through the Chrome Extension attack surface, which grants extensions elevated API access compared to regular web pages. When the extension invokes specific V8 code paths with crafted inputs, the engine behaves in a manner that permits arbitrary code execution within the renderer or extension sandbox. Because execution remains inside the sandbox, the attacker does not achieve direct escape to the host operating system through this issue alone.

Root Cause

The root cause is an implementation defect in V8 that fails to correctly enforce expected constraints when processing input reachable from an extension context. Google has not published low-level technical detail beyond the advisory summary. Additional information is tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires the attacker to distribute a malicious Chrome Extension and convince a target user to install it. Common distribution paths include social engineering, sideloading, typosquatted store listings, or supply-chain compromise of legitimate extensions. Once loaded, the extension issues crafted calls that exercise the vulnerable V8 code path to run attacker-controlled code inside the sandbox. Refer to the Chrome Release Update for the fixed build.

No verified public exploit code is available. The vulnerability is described in prose only; see the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-17952

Indicators of Compromise

Chrome installations reporting versions earlier than 151.0.7922.72 in endpoint inventory
Newly installed extensions loaded from outside the Chrome Web Store or via developer mode
Extensions requesting broad host permissions or scripting, debugger, or nativeMessaging APIs without business justification

Detection Strategies

Inventory installed browser extensions across managed endpoints and compare against an allowlist
Monitor for changes to the Chrome Extensions directory and modifications to the Preferences file that register new extension IDs
Alert on Chrome child processes spawning unexpected binaries or making anomalous outbound connections after extension installation events

Monitoring Recommendations

Ingest browser telemetry and process lineage into the SIEM to correlate extension installs with subsequent process behavior
Track Chrome version compliance continuously and flag hosts that fall behind the patched build
Review enterprise extension force-install and blocklist policies weekly for drift

How to Mitigate CVE-2026-17952

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Audit installed extensions and remove any that are unsigned, sideloaded, or unnecessary
Enforce enterprise policy to restrict extension installation to a vetted allowlist

Patch Information

Google addressed the issue in Chrome Stable 151.0.7922.72. Deployment details are documented in the Chrome Release Update. Chromium-based browsers should pick up the corresponding V8 fix in their next merge.

Workarounds

Configure the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to restrict which extensions users can install
Disable developer mode extension loading through the DeveloperToolsAvailability policy where feasible
Educate users to install extensions only from verified publishers on the Chrome Web Store

bash

# Configuration example: enforce Chrome extension allowlist via policy (Linux)
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/extensions.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}
EOF