CVE-2026-17749 is a critical vulnerability in Google Chrome's extension handling prior to version 151.0.7922.72. It stems from insufficient validation of untrusted input, which could allow a malicious Chrome extension, installed by a user, to perform a sandbox escape. This vulnerability affects the browser's security boundary, potentially enabling an attacker to execute code outside the intended sandbox environment. The CVSS v3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the input data, and no known exploits have been observed.

Successful exploitation could allow an attacker to escape the Chrome sandbox via a crafted malicious extension, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable arbitrary code execution outside the browser sandbox, significantly increasing the attack surface and risk to the user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid installing untrusted or suspicious Chrome extensions until an official fix is confirmed. Monitor official Google Chrome security advisories for updates and apply patches promptly once available.