PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17770 Google CVE debrief

CVE-2026-17770 is an out-of-bounds read vulnerability in the Media component of Google Chrome on Mac systems, classified as Medium severity with a CVSS score of 5.8. This issue, addressed in Google Chrome version 151.0.7922.72, could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The vulnerability was published on 2026-07-30T01:16:40.220Z and has not been modified since then. Administrators and users of Google Chrome on Mac systems should be aware of this vulnerability and take immediate action to update their browsers to prevent potential exploitation.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-07-31
Advisory published
2026-07-30
Advisory updated
2026-07-31

Who should care

Administrators and users of Google Chrome on Mac systems should be aware of this vulnerability and take immediate action to update their browsers to prevent potential exploitation.

Technical summary

CVE-2026-17770 is an out-of-bounds read vulnerability in the Media component of Google Chrome on Mac systems. This issue was addressed in Google Chrome version 151.0.7922.72. The vulnerability could allow a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. The CVSS score for this vulnerability is 5.8, indicating a medium severity level.

Defensive priority

Medium severity vulnerability in Google Chrome, requiring immediate attention to prevent potential sandbox escapes.

Recommended defensive actions

  • Apply the official patch to update Google Chrome to version 151.0.7922.72 or later on affected Mac systems.
  • Ensure that all users of Google Chrome on Mac systems are aware of this vulnerability and the importance of updating their browsers.
  • Monitor browser updates and security advisories for any additional information related to this vulnerability.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-17770 record indicates an out-of-bounds read vulnerability in Google Chrome's Media component on Mac systems prior to version 151.0.7922.72. This vulnerability, with a CVSS score of 5.8, could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The Chromium security team has classified this issue as Medium severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17770 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17770

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17770 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17770

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.