CVE-2026-17719: Google Chrome Use-After-Free Vulnerability

CVE-2026-17719 Overview

CVE-2026-17719 is a use-after-free vulnerability [CWE-416] in the Input component of Google Chrome. The flaw affects Chrome releases prior to 151.0.7922.72. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a targeted user. Google's Chromium security team rated the underlying issue as High severity. The vulnerability was addressed in the stable channel update announced by Google and tracked in the Chromium issue tracker as issue 522304853.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox through a crafted HTML page, enabling drive-by exploitation of any user who visits a malicious site.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable Input component
Downstream distributions shipping affected Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17719 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17719

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Input subsystem, which handles user input events routed through the renderer process. A use-after-free occurs when code continues to reference a heap object after the memory backing it has been released. An attacker who controls the allocation and free sequence can reclaim the freed slot with attacker-shaped data. Subsequent dereferences then operate on attacker-controlled memory, enabling control-flow hijacking or type confusion inside the renderer.

Exploitation is triggered by a crafted HTML page, meaning no authentication and no privileged position on the network is required. The resulting code execution occurs inside the Chrome sandbox, so a full compromise typically requires chaining a sandbox escape. The EPSS score for this CVE is 0.256% at the 17.2 percentile as of publication.

Root Cause

The defect is classified under [CWE-416: Use After Free]. In Chromium's Input pipeline, an object's lifetime is not correctly tied to all references that continue to use it, allowing a dangling pointer to persist after deallocation. Detailed root-cause information is restricted while patch adoption is ongoing. See the Chromium Issue Tracker Entry for further technical context once access is released.

Attack Vector

The attack vector is a malicious web page. An attacker hosts, or injects into a legitimate site, HTML and JavaScript that manipulates DOM input elements or event handlers in a sequence that triggers the freed reference. Common delivery paths include phishing links, malvertising, and compromised third-party scripts. Once the crafted page loads, the renderer executes attacker-controlled code within the sandbox boundary.

No verified proof-of-concept code has been released. Refer to the Google Chrome Update Post for vendor-confirmed details.

Detection Methods for CVE-2026-17719

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures shortly after browsing untrusted sites
Outbound connections from chrome.exe child processes to previously unseen domains immediately after page loads
Presence of Chrome versions earlier than 151.0.7922.72 on managed endpoints

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across the fleet and flag builds below 151.0.7922.72
Correlate browser crash telemetry with subsequent process spawns or file writes originating from renderer processes
Alert on unexpected child processes created by chrome.exe, which may indicate a successful renderer compromise chained with a sandbox escape

Monitoring Recommendations

Ingest browser crash and reliability telemetry into the SIEM for correlation with web proxy logs
Monitor URL categorization events for users visiting newly registered or low-reputation domains preceding Chrome crashes
Track patch compliance for Chrome across Windows, macOS, and Linux endpoints on a daily cadence

How to Mitigate CVE-2026-17719

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart browser sessions after the update to ensure the vulnerable process image is unloaded
Audit Chromium-based browsers such as Edge, Brave, and Opera for vendor-provided patches incorporating the Chromium fix

Patch Information

Google released the fix in the Chrome stable channel at version 151.0.7922.72. Details are published in the Google Chrome Update Post and tracked in the Chromium Issue Tracker Entry. Enterprise administrators should push the update through their standard browser management channel, such as Chrome Browser Enterprise policies or MDM-managed update rings.

Workarounds

Restrict browsing to allow-listed domains via web proxy or secure web gateway until patches are deployed
Enable site isolation and strict sandboxing policies through Chrome enterprise policies to reduce exploit reliability
Deploy browser update enforcement policies to prevent users from deferring the critical Chrome upgrade

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enforce minimum version via Chrome enterprise policy (JSON)
# Place under HKLM\SOFTWARE\Policies\Google\Chrome on Windows
# or /etc/opt/chrome/policies/managed/ on Linux
{
  "TargetVersionPrefix": "151.0.7922.72",
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 3600000
}