Google Chrome CVE-2026-17893

Exploitation requires two sequential preconditions: first, the attacker must achieve renderer process compromise through a separate vulnerability (this is the dominant limiting factor and is not trivially achievable), and second, the victim must be running Chrome on macOS specifically, as the affected Updater component is Mac-platform-specific. User interaction is required - the victim must visit or be redirected to an attacker-controlled or crafted HTML page to trigger the renderer-stage compromise. High attack complexity (AC:H) reflects that the renderer compromise prerequisite must be satisfied before this vulnerability is reachable. Chrome on Windows and Linux is not affected based on available data. No special account privileges or authentication are required for the initial network delivery stage.

The CVSS base score of 5.8 (Medium) with AC:H accurately reflects the substantial prerequisite - a prior renderer compromise - required before this vulnerability can be leveraged. EPSS at 0.18% / 8th percentile aligns with this high barrier: automated mass exploitation is implausible given the chained precondition. The scope change (S:C) is the most consequential risk signal: escaping Chrome's sandbox is the enabling step for broader macOS host-level compromise. No KEV listing and no public exploit code have been identified at time of analysis. Real-world priority is moderate - Chrome on macOS deployments should receive the patch as part of standard update cadence rather than emergency response. The Mac-platform specificity further limits blast radius compared to cross-platform vulnerabilities. The gap between CVSS severity and EPSS percentile is consistent and not conflicting - high CVSS reflects worst-case post-chain impact while EPSS reflects the low probability of exploitation given the required precondition.

An attacker crafts an HTML page exploiting a separate renderer vulnerability to compromise Chrome's renderer process on a target macOS system, then uses that foothold to submit malformed input to the privileged Chrome Updater component. The Updater's insufficient validation of this renderer-sourced input allows the attacker to escape the renderer sandbox and execute code at the Updater's elevated privilege level outside Chrome's security boundary. No public proof-of-concept for this chained scenario has been identified at time of analysis.