CVE-2026-17678 Google CVE debrief

Who should care

System administrators and users of Google Chrome, especially those in environments where Google Chrome is used for critical tasks or where the browser is exposed to untrusted web content, should be aware of this vulnerability and take immediate action to update Chrome to the latest version.

Technical summary

CVE-2026-17678 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome. This vulnerability, with a CVSS score of 8.8 and classified as High severity by Chromium, could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue was addressed in Google Chrome version 151.0.7922.72.

Defensive priority

High severity vulnerability in Google Chrome, requiring immediate attention to prevent potential sandbox escapes.

Recommended defensive actions

• Apply the latest Google Chrome update (version 151.0.7922.72 or later) to patched systems.
• Ensure all Google Chrome instances are updated to the latest version.
• Monitor Google Chrome for any subsequent updates or advisories related to this vulnerability.
• Restrict access to sensitive data and systems for users with compromised renderer processes.
• Implement additional security measures to prevent sandbox escapes, such as sandboxing and access controls.

Evidence notes

The CVE-2026-17678 record indicates an out-of-bounds read vulnerability in ANGLE within Google Chrome prior to version 151.0.7922.72. This issue, reported with a High severity by Chromium, could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Evidence is based on official CVE and NVD records, as well as vendor advisories.

Official resources