Google rated the V8 use-after-free in CVE-2026-17920 as 'Low' severity despite an 8.8 CVSS base score. The reason matters more than the rating itself: this UaF requires a malicious extension to be installed first, which puts it inside Chrome's extension sandbox before the vulnerability can be triggered. That's the technical constraint driving the Low rating — not business calculus, but a genuine exploitability hurdle. Modern Chrome's heap hardening and JIT mitigations make reliable UaF exploitation nontrivial even when you can reach the vulnerable code path.
What you should check: confirm your Chrome version is 151.0.7922.72 or later. If you manage Chrome deployments enterprise-wide, note that the Low severity label may cause your patch queue to deprioritize this — don't let that happen. The CVSS 8.8 score exists because the UaF itself is genuinely serious if chained correctly; the sandbox containment is what makes Google comfortable calling it Low, and that containment depends on users not installing malicious extensions in the first place.
The larger question worth holding: Chrome's extension API is largely legacy infrastructure at this point. The permission model still grants broad capabilities to extension code, and memory safety bugs in the V8 bridge that extensions use remain a real attack surface — not because this specific CVE is exploitable in practice, but because the extension ecosystem continues to provide an attack path that Chrome's severity taxonomy systematically rates lower than equivalent renderer bugs. Monitor your extension install policies accordingly.