CVE-2026-17918 is a use-after-free vulnerability in the Sync feature of Google Chrome versions before 151.0.7922.72. Exploitation requires user interaction (visiting a malicious HTML page) and could lead to arbitrary code execution within the sandbox environment. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The vendor has released a stable update to fix this issue as referenced in the official Chrome release blog.

Successful exploitation can result in arbitrary code execution inside the sandboxed environment of the browser, potentially compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and the vulnerability is contained within the sandbox, which limits the scope of impact. No active exploits have been reported.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for details.