CVE-2026-17979: Google Chrome V8 RCE Vulnerability

CVE-2026-17979 Overview

CVE-2026-17979 is a race condition [CWE-362] in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the race by serving a crafted HTML page to a targeted browser. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. Google's Chromium project classifies the security severity as Low, reflecting the sandbox containment of the impact.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome renderer sandbox by tricking a user into loading a malicious HTML page.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
V8 JavaScript engine bundled with affected Chrome builds
Chromium-based browsers that embed the vulnerable V8 release

Discovery Timeline

2026-07-30 - CVE-2026-17979 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17979

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. It is categorized as a race condition [CWE-362], meaning concurrent operations execute in an unexpected order. When two code paths in V8 access shared state without proper synchronization, an attacker can influence timing to reach an inconsistent internal state. That inconsistency can be leveraged to corrupt engine invariants and gain arbitrary code execution within the renderer process. Because Chrome isolates renderers, the code execution is confined to the sandbox unless combined with a separate sandbox escape.

Root Cause

The root cause is a race in V8 where operations on shared engine state are not fully serialized. Under specific timing conditions produced by attacker-controlled JavaScript, V8 reaches a state that violates its safety assumptions. Public references from Google and Chromium do not disclose the affected component names or the exploitation primitive. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor detail.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load an attacker-controlled HTML page, either by direct navigation or through an embedded resource such as an iframe or advertisement. No authentication is required. Execution is contained to the renderer sandbox based on the vendor description, so a full compromise of the host requires chaining with an additional sandbox escape.

No verified proof-of-concept code is publicly available. Refer to the vendor advisories for technical details.

Detection Methods for CVE-2026-17979

Indicators of Compromise

Chrome renderer process crashes or unexpected terminations correlated with visits to untrusted pages
Outbound connections from chrome.exe child processes to unrecognized domains after JavaScript-heavy page loads
Browser telemetry showing V8 exceptions or engine assertion failures on specific URLs

Detection Strategies

Inventory Chrome versions across the fleet and flag any endpoint running a build earlier than 151.0.7922.72
Monitor web proxy logs for user navigations to newly registered or low-reputation domains delivering JavaScript-heavy content
Correlate renderer crash reports with proximate network activity to identify potential exploitation attempts

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central data lake for cross-referencing Chrome version, process behavior, and network destinations
Alert on child processes spawned by chrome.exe that are not part of the expected browser process tree
Track patch compliance metrics for Chrome and Chromium-based browsers as an ongoing control

How to Mitigate CVE-2026-17979

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force a browser restart after update deployment to ensure the patched binary is loaded
Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have absorbed the corresponding V8 fix before considering them remediated

Patch Information

Google addressed the vulnerability in Chrome 151.0.7922.72 on the Stable channel. Deployment details are published in the Google Chrome Update Announcement. The corresponding V8 fix tracking is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict JavaScript execution on untrusted sites using enterprise browser policies until patches are applied
Enforce Site Isolation and strict sandboxing flags to reduce the blast radius of a renderer compromise
Use web filtering to block newly registered and low-reputation domains that are common delivery vectors for browser exploits

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux endpoints
google-chrome --version