What is the CVSS score of CVE-2026-17711?

CVE-2026-17711 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-17711?

Google Chrome on macOS versions prior to 151.0.7922.72 contains a critical vulnerability that could enable attackers to escape the browser sandbox and gain unrestricted system access, creating…. A patch is available.

How to fix or mitigate CVE-2026-17711?

Within 24 hours, notify all macOS users with Chrome installations of the available patch and create communication emphasizing the urgency of updating to version 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 across the organization through managed deployment tools (Google Admin Console for enterprise deployments), verify installation success on at least 95% of devices, and document patch deployment completion. Within 30 days, conduct a final compliance audit to confirm all macOS-based Chrome installations have been updated, monitor browser telemetry for any indicators of exploitation attempts, and establish a process to reduce update deployment timelines for future critical browser patches.

Google Chrome CVE-2026-17711

EUVD-2026-50837 CRITICAL

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-37xg-v5ff-wmh2

Information Disclosure Google Race Condition

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N and UI:R for the drive-by page; AC:H because success needs a pre-compromised renderer plus winning a non-deterministic race; S:C with C/I/A:H reflects a full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:30 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.

Technical ContextAI

The flaw is a CWE-362 concurrent execution / race condition (TOCTOU-class) in Chrome's Downloads subsystem, which coordinates fetching, staging, and writing files across multiple threads and IPC boundaries between the renderer and the privileged browser process. A malicious HTML page can drive the renderer to interleave download operations such that shared state is manipulated between a check and its use, letting attacker-controlled renderer code influence a privileged operation and cross the sandbox boundary. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*; the macOS-specific framing suggests the race is sensitive to platform download/file-handling behavior on that OS.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staged updates only take effect after relaunch. In managed fleets, push the update through your MDM/enterprise policy and confirm the running version rather than the installed version. There is no supported feature-level workaround for this internal race condition; because exploitation presupposes a compromised renderer, the practical compensating control until patching is to reduce renderer-compromise exposure - keep the rest of Chrome fully patched, enforce Site Isolation (default), and limit exposure to untrusted web content - accepting that these reduce but do not eliminate the risk of the underlying sandbox-escape bug.