CVE-2026-17770 Google CVE debrief

Who should care

Administrators and users of Google Chrome on Mac systems should be aware of this vulnerability and take immediate action to update their browsers to prevent potential exploitation.

Technical summary

CVE-2026-17770 is an out-of-bounds read vulnerability in the Media component of Google Chrome on Mac systems. This issue was addressed in Google Chrome version 151.0.7922.72. The vulnerability could allow a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. The CVSS score for this vulnerability is 5.8, indicating a medium severity level.

Defensive priority

Medium severity vulnerability in Google Chrome, requiring immediate attention to prevent potential sandbox escapes.

Recommended defensive actions

• Apply the official patch to update Google Chrome to version 151.0.7922.72 or later on affected Mac systems.
• Ensure that all users of Google Chrome on Mac systems are aware of this vulnerability and the importance of updating their browsers.
• Monitor browser updates and security advisories for any additional information related to this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-17770 record indicates an out-of-bounds read vulnerability in Google Chrome's Media component on Mac systems prior to version 151.0.7922.72. This vulnerability, with a CVSS score of 5.8, could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The Chromium security team has classified this issue as Medium severity.

Official resources