CVE-2026-17705: Google Chrome libxml RCE Vulnerability

CVE-2026-17705 Overview

CVE-2026-17705 is an integer overflow vulnerability in the libxml component used by Google Chrome versions prior to 151.0.7922.72. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. Google's Chromium team rates the security severity as High. The flaw is tracked under CWE-190: Integer Overflow or Wraparound.

Exploitation requires a user to visit an attacker-controlled or compromised page. Successful exploitation yields code execution constrained by the renderer sandbox, which attackers typically chain with a sandbox escape for full system compromise.

Critical Impact
Remote attackers can achieve arbitrary code execution within the Chrome renderer sandbox by delivering crafted HTML that triggers the libxml integer overflow.

Affected Products

Google Chrome (Desktop) versions prior to 151.0.7922.72
Chromium-based browsers that ship the vulnerable libxml component
Embedded frameworks and applications bundling affected Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17705 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17705

Vulnerability Analysis

The vulnerability resides in libxml, the XML parsing library integrated into Chrome for handling XML content within web pages. An integer overflow in the parser causes arithmetic operations on size or length values to wrap past their maximum representable value. The wrapped value is then used in subsequent memory allocation or indexing operations, producing an undersized buffer or out-of-bounds access.

Because libxml runs inside the renderer process, exploitation grants the attacker execution primitives within the renderer's sandbox. Attackers commonly pair renderer bugs of this class with a separate sandbox escape to gain code execution at the user's privilege level. The EPSS probability at publication is 0.354% with a percentile of 28.152.

Root Cause

The root cause is unchecked arithmetic on integer values used to size buffers or drive parser loops during XML processing. When the computed value overflows, downstream code operates on an inconsistent view of memory. Refer to the Chromium Issue Tracker entry and the Google Chrome Update Blog for vendor context.

Attack Vector

A remote attacker hosts a crafted HTML page that embeds XML content structured to trigger the overflow in libxml. When a user loads the page in an unpatched Chrome build, the parser processes the malformed input and reaches the vulnerable code path. No authentication is required, and interaction is limited to visiting the page. Details are described in prose only, as no verified exploit code is publicly referenced in the advisory sources.

Detection Methods for CVE-2026-17705

Indicators of Compromise

Chrome renderer processes crashing with memory access violations after loading XML-heavy pages
Outbound connections from renderer child processes to unfamiliar domains following browsing sessions
Creation of unexpected child processes or files under the Chrome user profile directory
Browser telemetry showing versions of Chrome earlier than 151.0.7922.72 still active on endpoints

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor for anomalous renderer process behavior such as unexpected file writes, network calls, or module loads
Correlate browser crash reports with visits to newly observed or low-reputation domains

Monitoring Recommendations

Ingest endpoint browser version telemetry into a central log platform and alert on outdated Chrome installations
Track process lineage from chrome.exe renderer children and alert on deviations from baseline
Review web proxy logs for HTML responses containing unusually large or malformed XML payloads

How to Mitigate CVE-2026-17705

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Verify that Chromium-based browsers and embedded WebViews in the environment ship a patched libxml
Enforce automatic browser updates through enterprise policy to prevent version drift
Restrict use of unmanaged or end-of-life Chromium forks that may not receive the fix

Patch Information

Google released the fix in the Stable channel update announced on the Google Chrome Update Blog. Deploy Chrome 151.0.7922.72 or newer. Downstream Chromium-based browsers should be updated to the vendor release that incorporates the corresponding libxml fix.

Workarounds

Block access to untrusted sites through web filtering while patches are rolled out
Disable or restrict rendering of XML content in high-risk user groups where feasible
Apply site isolation and strict sandboxing policies via enterprise Chrome group policy

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version