What is the CVSS score of CVE-2026-17864?

CVE-2026-17864 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-17864?

Google Chrome's auto-update component for macOS contains a privilege escalation vulnerability (CVE-2026-17864) affecting versions prior to 151.0.7922.72, allowing local attackers to elevate system…. A patch is available.

How to fix or mitigate CVE-2026-17864?

Within 24 hours, inventory Chrome installations across macOS systems and verify current versions to establish baseline scope and identify at-risk endpoints. Over the next 7 days, deploy Chrome version 151.0.7922.72 or later through your standard update mechanism, prioritizing systems accessible to untrusted local users or handling sensitive data. By day 30, confirm 100% compliance through endpoint telemetry and conduct a spot-check audit of any remaining systems on earlier versions to close gaps.

Google Chrome CVE-2026-17864

EUVD-2026-50613 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-m6p7-44xj-v2x9

Privilege Escalation Google

High

Disputed · 7.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and no starting privileges match a local user planting a file, with mandatory user interaction gating the privileged Updater action and full OS-level compromise impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:28 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.8

DescriptionCVE.org

Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local OS-level privilege escalation in Google Chrome's Updater component on macOS versions prior to 151.0.7922.72 allows a local attacker to elevate privileges by planting a malicious file that the Updater processes with higher rights. The flaw stems from improper privilege management (CWE-269) in the auto-update workflow, requires local access plus user interaction, and carries a CVSS 7.8 (High) rating; no public exploit has been identified at time of analysis. Rated Medium severity by Chromium's own security team despite the High CVSS.

Technical ContextAI

The affected component is Chrome's Updater on macOS - the background service (historically Keystone/GoogleUpdater) responsible for fetching and installing browser updates, which typically runs with elevated privileges to write into system-level install locations. The root cause is classified as CWE-269 (Improper Privilege Management): the Updater's handling of a file allows a lower-privileged local user to influence an operation executed at a higher privilege level, resulting in OS-level escalation. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected application, and the issue is macOS-specific per the advisory. Because the Updater operates as a privileged helper, weaknesses in how it validates or trusts on-disk files can be leveraged to cross a privilege boundary that the browser sandbox is not designed to protect.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to 151.0.7922.72 or later, delivered through the Stable Channel update announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because the vulnerability is in the auto-update mechanism itself, confirm the update actually applied by checking chrome://settings/help and relaunching the browser, and in managed fleets push the fixed version via MDM rather than relying solely on background auto-update. As a compensating control until patched, restrict local/interactive access to macOS endpoints and avoid running as or granting admin rights to untrusted local users, since exploitation requires a local attacker to place a malicious file and induce user interaction; this reduces exposure but does not eliminate the underlying Updater flaw. Reference the tracking issue https://issues.chromium.org/issues/520494861 for vendor detail.