CVE-2026-17710: Google Chrome MHTML RCE Vulnerability

CVE-2026-17710 Overview

CVE-2026-17710 affects Google Chrome on macOS prior to version 151.0.7922.72. The vulnerability stems from an inappropriate implementation in MIME HTML (MHTML) handling. A remote attacker who has already compromised the renderer process can potentially perform a sandbox escape through a crafted HTML page. Google's Chromium security team rated this issue at High severity.

The flaw requires prior renderer compromise, making it a second-stage bug commonly chained with a renderer exploit to achieve full browser sandbox escape on macOS.

Critical Impact
Attackers with a compromised renderer process can escape the Chrome sandbox on macOS, gaining code execution outside the renderer's restricted context.

Affected Products

Google Chrome on macOS prior to 151.0.7922.72
Chromium-based browsers on macOS that share the MHTML implementation
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17710 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17710

Vulnerability Analysis

The vulnerability resides in Chrome's MHTML component on macOS. MHTML is a web page archive format that bundles HTML, images, and other resources into a single MIME-encoded file. Chrome's implementation on macOS prior to 151.0.7922.72 incorrectly handles crafted MHTML content in a way that allows a compromised renderer to influence higher-privileged browser process behavior.

Because the flaw is exploitable only from an already-compromised renderer, it functions as a sandbox escape primitive rather than an initial-access bug. Attackers typically pair it with a separate renderer-level vulnerability (for example, a V8 or Blink bug) to build a full exploit chain from a malicious web page to code execution on the host.

Root Cause

Google classifies the issue as an inappropriate implementation in MHTML. The public advisory does not disclose the specific code path. Details are restricted in the Chromium issue tracker entry 519991712 pending broad patch adoption, consistent with Google's standard disclosure practice for sandbox escape bugs.

Attack Vector

Exploitation requires two conditions: the victim must load a crafted HTML page, and the attacker must already control the renderer process. Once both hold, the crafted MHTML content triggers the flawed code path and enables the sandbox escape on macOS. The vulnerability is not exploitable directly from a benign renderer without a prior compromise primitive.

No verified public proof-of-concept code is available. Refer to the Google Chrome Releases advisory and the Chromium Issue Tracker entry for vendor details.

Detection Methods for CVE-2026-17710

Indicators of Compromise

Chrome renderer or helper processes on macOS spawning unexpected child processes or writing outside the Chrome sandbox container
Unusual .mhtml or multipart/related content served from untrusted origins immediately followed by renderer instability
Chrome crash reports on macOS referencing MHTML parsing paths on versions earlier than 151.0.7922.72

Detection Strategies

Inventory macOS endpoints running Google Chrome and flag any build below 151.0.7922.72
Monitor for behavioral anomalies from Chrome helper processes such as unexpected file writes, network calls, or privilege transitions consistent with sandbox escape activity
Correlate browser crash telemetry with subsequent process creation events to identify possible exploit chains

Monitoring Recommendations

Enable endpoint telemetry capable of tracing parent-child process relationships from Chrome helper processes on macOS
Ingest browser version data into asset inventory and alert on outdated Chrome installations
Track outbound requests delivering MHTML content from untrusted domains to browser clients

How to Mitigate CVE-2026-17710

Immediate Actions Required

Update Google Chrome on macOS to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after update to ensure the patched binaries are loaded
Audit Chromium-based browsers and Electron applications on macOS for embedded Chromium versions predating the fix

Patch Information

Google addressed the issue in the Stable channel update announced in the Chrome Releases blog post. Upgrade macOS clients to Chrome 151.0.7922.72 or higher. Enterprise administrators should push the update through MDM, Google Update, or the organization's software distribution channel.

Workarounds

No official workaround exists; apply the vendor patch as the primary remediation
Restrict user browsing to trusted sites and block delivery of MHTML content at the web proxy where feasible
Enforce least-privilege macOS user accounts to limit post-escape impact until patching completes

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome to check for updates via Google Update
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES