What is the CVSS score of CVE-2026-17654?

CVE-2026-17654 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-17654?

Google Chrome's Updater on macOS versions before 151.0.7922.72 can be exploited by attackers with local system access to gain administrative privileges, potentially taking over affected machines.. A patch is available.

How to fix or mitigate CVE-2026-17654?

Within 24 hours, inventory all macOS systems to identify those running Google Chrome versions prior to 151.0.7922.72. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected macOS systems using your standard patch management process, prioritizing high-risk and client-facing systems. Within 30 days, conduct a security assessment of systems that experienced prolonged exposure to identify any indicators of compromise, and implement automated Chrome version monitoring to prevent future exposure gaps.

Google Chrome CVE-2026-17654

EUVD-2026-50780 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-vmw9-hq9j-9x52

Privilege Escalation Google Race Condition

7.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local attack requiring a malicious file and user interaction, with AC:H because winning the CWE-362 race is a timing-dependent condition; full CIA impact via privilege escalation.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:24 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 7.8

DescriptionCVE.org

Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical)

AnalysisAI

Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.

Technical ContextAI

The flaw resides in the Google Chrome Updater component, the privileged auto-update mechanism (on macOS, historically the Keystone/GoogleUpdater service) that runs with elevated rights to install browser updates. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization - a race condition) is the root cause: a window exists between a check and a use (e.g., file validation and file operation) that a local attacker can interleave with a malicious file to cause the privileged updater to act on attacker-controlled content, yielding OS-level privilege escalation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected application is Google Chrome, specifically its macOS build.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Chrome Stable channel; the fix is documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome updates apply through the same Updater component involved here, verify the update actually completed (Chrome menu → About Google Chrome forces an update check and relaunch) rather than assuming background auto-update ran. As a compensating control until patched, restrict local access to shared/writable locations the updater relies on and limit which local users can drop files onto the endpoint, since exploitation requires a local attacker to place a malicious file - the trade-off is that tightening local filesystem permissions offers only partial mitigation and does not close the race window itself, so patching is the only reliable fix.