What is the CVSS score of CVE-2026-17709?

CVE-2026-17709 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17709?

Google Chrome for macOS prior to version 151.0.7922.72 contains a critical sandbox-bypass vulnerability (CVE-2026-17709) with no current public exploits, but which could allow attackers to escalate…. A patch is available.

How to fix or mitigate CVE-2026-17709?

Begin within 24 hours by assessing all macOS endpoints for Chrome versions below 151.0.7922.72 using chrome://settings/help, and enable auto-update on any systems where it is disabled. Deploy Chrome 151.0.7922.72 or later across all macOS endpoints within 7 days through standard patch management, targeting at least 95% installation rate and validating through MDM or endpoint monitoring systems. Complete full remediation by day 30, confirm 100% of endpoints are running patched versions, and audit system logs for any suspicious Chrome-related incidents that may have occurred during the vulnerable period.

Google Chrome CVE-2026-17709

EUVD-2026-50835 CRITICAL

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-4xr6-2mhc-hp25

Information Disclosure Google Race Condition

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N) but requires winning a race plus a pre-existing renderer compromise, so AC:H; sandbox escape crosses a trust boundary (S:C) with total impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:33 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw is a race condition (CWE-362, concurrent execution using shared resource with improper synchronization) in Chrome's Downloads subsystem, which coordinates between the sandboxed renderer process and the higher-privileged browser process to write files to disk. On macOS the browser process brokers privileged operations on behalf of the renderer; a timing window in how the Downloads code handles concurrent state allows a compromised renderer to manipulate shared resources and cross the process/sandbox boundary. The affected CPE is cpe:2.3:a:google:chrome (all versions below the fix), and this specific bug is scoped to the Mac platform per the vendor description.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade macOS Chrome to 151.0.7922.72 or later via the Stable Channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html), then fully relaunch the browser so the new binary is loaded, since Chrome applies updates only on restart. In managed fleets, push the update through your MDM/enterprise update policy and confirm the effective version. Because exploitation requires a compromised renderer first, defense-in-depth against the initial renderer break is the meaningful compensating control if you cannot patch immediately: keep Site Isolation enabled (default), avoid disabling the sandbox, and limit exposure to untrusted web content; these have negligible functional trade-offs. There is no product-specific workaround for the race itself, so patching is the only complete fix.