CVE-2026-17654 Overview
CVE-2026-17654 is a race condition in the Updater component of Google Chrome on macOS prior to version 151.0.7922.72. A local attacker can exploit the race window using a malicious file to escalate privileges to the operating system level. Google classifies the underlying Chromium issue at Critical severity, while the National Vulnerability Database assigns a CVSS 3.1 base score of 7.8. The weakness is tracked under CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization.
Critical Impact
Successful exploitation grants OS-level privilege escalation on macOS endpoints running vulnerable Chrome builds, allowing attackers to gain elevated access from a standard user context.
Affected Products
- Google Chrome for macOS versions prior to 151.0.7922.72
- Chromium-based builds sharing the vulnerable Updater component on macOS
- Managed macOS fleets with delayed Chrome auto-update enforcement
Discovery Timeline
- 2026-07-30 - CVE-2026-17654 published to the National Vulnerability Database
- 2026-07-30 - Last updated in the NVD database
- Fix shipped in Chrome stable channel 151.0.7922.72 per the Google Chrome Release Update
Technical Details for CVE-2026-17654
Vulnerability Analysis
The flaw resides in the Chrome Updater on macOS. The Updater runs with elevated privileges to install and maintain browser binaries and helper components. A race condition between file validation and file use allows a local attacker to substitute a malicious file during the update workflow. When the privileged Updater acts on the swapped file, attacker-controlled code executes with elevated rights. This is a classic time-of-check time-of-use (TOCTOU) pattern within a privileged system service. Additional context is tracked in Chromium Issue #522314940.
Root Cause
The root cause is improper synchronization between file state verification and file operation inside the Updater. The Updater trusts a file reference after checks pass, but the underlying inode, path, or attributes can be altered by a concurrent local process before the privileged action completes. This maps directly to [CWE-362] concurrent execution with improper synchronization on a shared resource.
Attack Vector
Exploitation requires local access and user interaction, consistent with the CVSS attack vector for this CVE. An attacker with a foothold as a standard user plants a malicious file and races the Updater during an update-related operation. Winning the race causes the privileged Updater to operate on attacker-controlled content, yielding OS-level privilege escalation on the macOS host.
No public exploit is currently listed for CVE-2026-17654, and it is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.15%.
Detection Methods for CVE-2026-17654
Indicators of Compromise
- Unexpected file creation, replacement, or symlink activity in Chrome Updater working directories on macOS such as paths under ~/Library/Application Support/Google/Chrome and /Library/Google/GoogleUpdater.
- Child processes spawned by the Chrome Updater (GoogleUpdater, ksadmin, or GoogleSoftwareUpdateAgent) executing non-Google-signed binaries.
- Privilege transitions where a standard user session immediately precedes root-level activity tied to the Updater.
Detection Strategies
- Monitor macOS Endpoint Security events (ES_EVENT_TYPE_NOTIFY_RENAME, ES_EVENT_TYPE_NOTIFY_LINK, ES_EVENT_TYPE_NOTIFY_EXEC) on Chrome Updater paths for rapid create-rename-execute sequences indicative of a TOCTOU race.
- Alert on Chrome versions below 151.0.7922.72 reported by inventory or EDR telemetry.
- Correlate Updater process executions with concurrent file operations from non-Updater processes on the same target paths.
Monitoring Recommendations
- Track code signature validation results for binaries loaded or executed by GoogleUpdater and reject unsigned or non-Google signatures.
- Ingest macOS Unified Log entries from com.google.GoogleUpdater and com.apple.securityd into your SIEM for behavioral baselining.
- Watch for anomalous privilege escalations originating from user sessions that recently interacted with Chrome update prompts or downloads.
How to Mitigate CVE-2026-17654
Immediate Actions Required
- Update Google Chrome on all macOS endpoints to 151.0.7922.72 or later using MDM, Jamf, Munki, or Chrome Enterprise policies.
- Verify the installed version with mdls -name kMDItemVersion /Applications/Google\ Chrome.app and remediate hosts below the patched build.
- Restrict local access on shared or multi-user macOS systems until patch deployment is confirmed.
Patch Information
Google released Chrome 151.0.7922.72 for macOS to address CVE-2026-17654 as documented in the Google Chrome Release Update. Applying the patch remediates the race in the Updater component. Chromium tracking details are available in Chromium Issue #522314940.
Workarounds
- No vendor-supplied workaround eliminates the vulnerability; only the patched version fully resolves it.
- Limit interactive local logins on macOS endpoints to trusted users to reduce the local attack surface.
- Enforce Chrome auto-update via enterprise policy so future updater fixes deploy without user action.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
