CVE-2026-17712: Google Chrome Skia RCE Vulnerability

CVE-2026-17712 Overview

CVE-2026-17712 is a race condition vulnerability in the Skia graphics library used by Google Chrome on macOS. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the issue by serving a crafted HTML page, allowing arbitrary code execution inside the browser sandbox. Google's Chromium security team rated the internal severity as High. The vulnerability is tracked in Chromium Issue #520535595 and addressed in the Stable Channel Update for Desktop. The underlying weakness maps to [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
A crafted web page can trigger a race in Skia to execute arbitrary code inside the Chrome renderer sandbox on macOS.

Affected Products

Google Chrome for macOS versions prior to 151.0.7922.72
Chromium-based browsers on macOS that bundle vulnerable Skia code
Applications embedding affected Chromium releases on macOS

Discovery Timeline

2026-07-30 - CVE-2026-17712 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17712

Vulnerability Analysis

The vulnerability resides in Skia, the 2D graphics library that Chrome uses to render web content, canvas elements, and compositor layers. Skia performs graphics operations across multiple threads, including the renderer main thread, raster workers, and GPU threads. A race condition occurs when two threads access shared graphics state without proper synchronization. An attacker who wins the race can corrupt Skia's internal state and steer execution to attacker-controlled code paths inside the renderer process.

The resulting code execution is confined to the Chrome renderer sandbox on macOS. An attacker still gains a foothold suitable for chaining with a sandbox escape to reach the host. The Chromium Issue #520535595 tracks the specific defect and fix.

Root Cause

The root cause is improper synchronization of shared graphics resources within Skia [CWE-362]. Concurrent operations on the same object create a time-of-check to time-of-use window. During that window, memory state observed by one thread does not match the state acted upon by another, yielding memory safety violations exploitable for control-flow hijack.

Attack Vector

Exploitation requires only that a victim load a crafted HTML page in a vulnerable Chrome build. The attacker delivers JavaScript and graphics content that drives Skia into the racy code path, typically by issuing rapid rendering, canvas, or compositor operations. No user interaction beyond page navigation is required. Delivery channels include drive-by downloads, malicious advertisements, and compromised sites.

No verified public exploit code is available for CVE-2026-17712. See the Chromium security advisory for release-specific technical details.

Detection Methods for CVE-2026-17712

Indicators of Compromise

Chrome renderer processes on macOS crashing with signals such as SIGSEGV or SIGBUS referencing Skia frames in crash dumps.
Unexpected child processes spawned by Google Chrome Helper (Renderer) shortly after visiting a specific URL.
Outbound network connections from renderer processes to previously unseen domains immediately after page load.
Chrome versions on macOS endpoints reporting a build older than 151.0.7922.72 in inventory data.

Detection Strategies

Inventory installed Chrome versions across macOS fleet and flag any build below 151.0.7922.72.
Monitor process telemetry for anomalous behavior originating from Google Chrome Helper renderer processes, such as file writes, execve calls, or shell spawning.
Correlate browser crash reports with URL history to identify pages that repeatedly crash Skia.
Ingest DNS and proxy logs to identify visits to domains associated with known Chrome exploitation campaigns.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry to capture process creation, memory protection changes, and code signing anomalies for Chrome helper processes.
Forward Chrome crash reports and macOS ReportCrash artifacts to a central SIEM for triage.
Track browser version compliance as a continuous control rather than a point-in-time check.

How to Mitigate CVE-2026-17712

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 151.0.7922.72 or later.
Restart Chrome after the update so that the patched binaries are loaded into memory.
Verify the applied build using chrome://settings/help or MDM inventory reports.
Prioritize patching for users who browse untrusted content, handle sensitive data, or operate with elevated privileges.

Patch Information

Google addressed CVE-2026-17712 in the Chrome Stable channel for macOS at version 151.0.7922.72. Refer to the Google Chrome Desktop Update release notes and Chromium Issue #520535595 for build details. Chromium-derived browsers should pick up the fix once they rebase on the corresponding Chromium version.

Workarounds

Deploy the vendor patch; no reliable configuration-based workaround exists for a Skia race condition.
Restrict browsing to trusted sites through enterprise policy until patching completes.
Use site isolation and enforce Safe Browsing enhanced protection via Chrome enterprise policies.
Consider temporarily disabling hardware-accelerated rendering with --disable-gpu only as a stopgap; this does not fully remove Skia code paths and should not replace patching.

bash

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update via Google Software Update (per-user)
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES

# Enforce minimum version via configuration profile key
# Domain: com.google.Chrome
# Key: MinimumRequiredVersion
# Value: 151.0.7922.72
defaults write com.google.Chrome MinimumRequiredVersion -string "151.0.7922.72"