CVE-2026-17948 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. It affects Chrome versions before 151.0.7922.72. An attacker can exploit this by tricking a user into installing a crafted malicious Chrome extension, which then enables arbitrary code execution inside the sandbox. The vulnerability is rated high severity with a CVSS v3.1 score of 7.5, reflecting network attack vector, high complexity, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix was released in Chrome 151.0.7922.72.

Successful exploitation allows arbitrary code execution inside the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction in the form of installing a malicious extension. No active exploitation has been reported.

Users and administrators should update Google Chrome to version 151.0.7922.72 or later to remediate this vulnerability. The vendor advisory confirms this version contains the fix. No additional mitigation is required if the update is applied.