CVE-2026-17692 Google CVE debrief

Who should care

Organizations and individuals using Google Chrome on Windows should prioritize patching this vulnerability as it allows for potential sandbox escape and remote code execution. This vulnerability is particularly concerning for environments where Chrome is used for critical tasks or to access sensitive information.

Technical summary

The CVE-2026-17692 vulnerability is a use-after-free issue in the DataTransfer component of Google Chrome on Windows. It was reported with a CVSS score of 9.6 and a severity of CRITICAL. The vulnerability allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is resolved in Google Chrome version 151.0.7922.72 or later.

Defensive priority

This vulnerability has a high CVSS score of 9.6 and is classified as CRITICAL. It allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page in Google Chrome on Windows prior to version 151.0.7922.72.

Recommended defensive actions

• Apply the official patch: Upgrade Google Chrome to version 151.0.7922.72 or later
• Inventory and monitor Google Chrome installations to ensure they are up-to-date
• Implement compensating controls such as sandboxing and isolation for critical systems
• Monitor for suspicious activity and implement additional security measures to prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-17692 vulnerability is a use-after-free issue in the DataTransfer component of Google Chrome on Windows. It was reported with a CVSS score of 9.6 and a severity of CRITICAL. The vulnerability allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is resolved in Google Chrome version 151.0.7922.72 or later.

Official resources