CVE-2026-17746 Google CVE debrief

Who should care

Users of Google Chrome on Mac systems, particularly those exposed to untrusted sources, should be aware of this vulnerability and take necessary precautions. This includes updating Google Chrome to version 151.0.7922.72 or later, monitoring for suspicious HTML page activity, and restricting access to untrusted sources. Additionally, security teams and vulnerability management teams should review the CVE record and assess their exposure to this vulnerability. Operators of Google Chrome on Mac systems should also review their systems and ensure they are up-to-date with the latest version of Google Chrome. Platform administrators should verify that their systems are patched and up-to-date. Vulnerability management teams should review the CVE record and assess their exposure to this vulnerability. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory teams should verify that all Google Chrome installations on Mac systems are up-to-date with the latest version. Rollback/change windows teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Monitoring teams should check relevant monitoring, detection, and logs for exposed assets that need extra review. Compensating controls teams should review compensating controls for exposed systems while remediation is scheduled and verified. Exposure review teams should review the CVE record and assess their exposure to this vulnerability. Vendor patch guidance teams should apply the update to Google Chrome version 151.0.7922.72 or later. Asset inventory teams should review their asset inventory to ensure all Google Chrome installations on Mac systems are up-to-date with the latest version. Monitoring teams should monitor for suspicious HTML page activity. Compensating controls teams should restrict access to untrusted sources. Rollback/change windows teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The CVE-2026-17746 vulnerability is a use-after-free issue in the GPU of Google Chrome on Mac systems prior to version 151.0.7922.72. This vulnerability could potentially allow a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. The Chromium security severity is rated as Medium with a CVSS score of 5.8. The vulnerability affects Google Chrome on Mac systems and can be mitigated by updating to version 151.0.7922.72 or later. Users should also monitor for suspicious HTML page activity and restrict access to untrusted sources.

Defensive priority

Medium severity vulnerability in Google Chrome's GPU, potentially allowing sandbox escape.

Recommended defensive actions

• Apply the update to Google Chrome version 151.0.7922.72 or later
• Monitor for suspicious HTML page activity
• Restrict access to untrusted sources
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-17746 vulnerability is described as a use-after-free issue in the GPU of Google Chrome on Mac systems prior to version 151.0.7922.72. This vulnerability could potentially allow a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. The Chromium security severity is rated as Medium with a CVSS score of 5.8.

Official resources