CVE-2026-17735: Google Chrome BFCache RCE Vulnerability

CVE-2026-17735 Overview

CVE-2026-17735 affects the Back-Forward Cache (BFCache) component in Google Chrome versions prior to 151.0.7922.72. The flaw stems from insufficient validation of untrusted input [CWE-20]. A remote attacker who has already compromised the renderer process can potentially perform a sandbox escape through a crafted HTML page. Google classified the Chromium security severity as Medium. The vulnerability requires prior renderer compromise, making it a chained exploitation primitive rather than a standalone entry point.

Critical Impact
An attacker with control over a compromised renderer process can escape the Chrome sandbox and gain broader access to the host system through a crafted HTML page.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable BFCache implementation
All operating system platforms shipping the affected Chrome Stable channel

Discovery Timeline

2026-07-30 - CVE-2026-17735 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17735

Vulnerability Analysis

BFCache is a browser optimization that keeps fully rendered pages in memory when a user navigates away. When the user returns using back or forward navigation, the cached page loads instantly. The cache preserves JavaScript state, the Document Object Model (DOM), and associated renderer resources.

CVE-2026-17735 stems from insufficient validation of untrusted input handled by BFCache. An attacker who has already achieved code execution inside the renderer process can craft malicious HTML content that manipulates cached state in ways the browser process does not expect. This mismatch enables the renderer to influence privileged operations across the process boundary.

The issue falls under [CWE-20: Improper Input Validation]. Because sandbox escapes break the security model separating web content from host resources, this class of bug is a common target in exploit chains that begin with a renderer-side memory corruption or type confusion vulnerability.

Root Cause

The BFCache implementation does not adequately validate data received from the renderer during page restoration or cache management operations. A compromised renderer supplies inputs that bypass expected constraints in the browser process, which handles them under higher privilege.

Attack Vector

Exploitation requires two stages. First, the attacker compromises the renderer process, typically through a separate memory corruption or logic bug delivered by a malicious website. Second, the attacker uses a crafted HTML page interacting with BFCache to trigger the validation flaw and escape the sandbox. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for release-level details.

Detection Methods for CVE-2026-17735

Indicators of Compromise

Chrome browser processes spawning unexpected child processes outside standard renderer, GPU, and utility hierarchies
Renderer processes making system calls or file system access inconsistent with sandboxed operation
Unexpected outbound network connections initiated by Chrome subprocesses following navigation events

Detection Strategies

Monitor Chrome process trees for anomalous parent-child relationships, particularly non-standard executables launched by chrome.exe
Inspect endpoint telemetry for renderer processes performing operations reserved for the broker process, such as arbitrary file writes
Correlate navigation events with process behavior changes to identify BFCache-related exploitation attempts

Monitoring Recommendations

Track Chrome version inventory across managed endpoints and flag any installation below 151.0.7922.72
Alert on browser sandbox violation events surfaced by endpoint detection tooling
Review web proxy logs for repeat visits to unknown domains that coincide with browser crashes or unexpected process launches

How to Mitigate CVE-2026-17735

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome on all systems after patching to ensure the vulnerable code is unloaded from memory
Audit Chromium-based browsers such as Edge, Brave, and Opera for updates incorporating the upstream fix

Patch Information

Google addressed CVE-2026-17735 in the Chrome Stable channel release 151.0.7922.72. Deployment details are available in the Google Chrome Stable Update advisory. Administrators should push the update through enterprise management channels and verify installation across the fleet.

Workarounds

No official workaround replaces patching; apply the vendor update as the primary remediation
Restrict browsing to trusted sites and enforce web content filtering to reduce exposure to malicious pages that could compromise the renderer
Enforce Chrome enterprise policies that limit extensions and untrusted content until patch deployment completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows PowerShell: query installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS: check Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version