Description
Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Published: 2026-07-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a type confusion bug in the V8 JavaScript engine of Google Chrome (CWE-843). An attacker who tricks a user into installing a malicious Chrome extension can use this bug to execute arbitrary code inside the browser's sandbox. The result is confidential data exposure, credential theft, or further attacks limited to the sandboxed environment.

Affected Systems

The vulnerability affects all installations of Google Chrome that are earlier than version 151.0.7922.72. Users running 151.0.7922.72 or later are not susceptible.

Risk and Exploitability

The CVSS score of 7.5 marks the flaw as high impact, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the user to install a malicious extension, a scenario that relies on social engineering or compromised extension marketplaces. Once the extension is installed, the attacker can run code with sandbox privileges, potentially escalating if additional weaknesses exist.

Generated by OpenCVE AI on August 2, 2026 at 06:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or newer.
  • Remove any suspicious or unverified extensions from installed browsers.
  • Restrict extension installation in managed environments or via policy to prevent unauthorized extensions.

Generated by OpenCVE AI on August 2, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Type Confusion in V8
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L'}

threat_severity

Low

Thu, 30 Jul 2026 06:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Weaknesses CWE-843
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-31T03:55:44.170Z

Reserved: 2026-07-27T23:37:06.345Z

Link: CVE-2026-17948

cve-icon Vulnrichment

Updated: 2026-07-30T12:52:47.155Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:59.120

Modified: 2026-08-03T17:31:34.787

Link: CVE-2026-17948

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-30T00:25:39Z

Links: CVE-2026-17948 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T06:15:12Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')