CVE-2026-17738: Google Chrome Payments RCE Vulnerability

CVE-2026-17738 Overview

CVE-2026-17738 is an input validation vulnerability [CWE-20] in the Payments component of Google Chrome prior to version 151.0.7922.72. The flaw allows a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox by delivering a crafted HTML page. Chromium's security team rated the issue Medium severity. Sandbox escape vulnerabilities are typically chained with a preceding renderer exploit to achieve broader system access from a browser tab. Google addressed the issue in the Stable channel update for Chrome 151.

Critical Impact
An attacker with renderer process control can escape the Chrome sandbox via a crafted HTML page targeting the Payments component, expanding the impact of an initial browser compromise.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating vulnerable Payments code paths
Any deployment of Chrome that has not applied the Stable channel update referenced in the July 2026 advisory

Discovery Timeline

2026-07-30 - CVE-2026-17738 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17738

Vulnerability Analysis

The vulnerability resides in the Payments component of Chrome, which handles the Web Payment Request API and related payment-handler flows. Insufficient validation of untrusted input allows a compromised renderer to send crafted data that the browser process fails to properly sanitize. This gap creates a pathway for renderer-to-browser boundary violation, undermining the sandbox model that isolates untrusted web content from higher-privileged browser components.

The attacker prerequisite is significant: the renderer process must already be compromised through a separate initial vulnerability. Exploit chains commonly pair a renderer memory corruption bug with a sandbox escape such as this one to move from web content execution to code execution outside the sandbox.

Root Cause

The root cause is improper input validation [CWE-20] in Payments IPC handling. The browser process trusts data structures or parameters supplied by the renderer without sufficient checks, which a compromised renderer can abuse to influence privileged operations.

Attack Vector

Exploitation requires a two-stage attack. First, the attacker compromises the renderer through an unrelated vulnerability or a malicious HTML page delivered via a controlled site, phishing lure, or malvertising. Second, the compromised renderer issues crafted Payments-related messages that trigger the validation gap in the browser process, enabling sandbox escape. Refer to the Chromium Issue Tracker Entry and the Chrome Blog Update for vendor detail.

No verified public proof-of-concept code is available. Technical exploitation details remain restricted pending broader patch adoption.

Detection Methods for CVE-2026-17738

Indicators of Compromise

Chrome browser processes spawning unexpected child processes or writing to non-standard file paths shortly after visiting an untrusted site
Renderer processes making unusual IPC calls or interacting abnormally with the Payments service
Endpoints running Chrome versions below 151.0.7922.72 in enterprise inventories

Detection Strategies

Inventory Chrome and Chromium-derived browser versions across the fleet and flag hosts below 151.0.7922.72
Monitor for post-exploitation behavior downstream of a browser compromise, including credential access, persistence, and lateral movement originating from chrome.exe or its child processes
Correlate browser telemetry with EDR process-lineage data to identify anomalous parent-child relationships involving the Chrome browser process

Monitoring Recommendations

Enable browser telemetry and forward it to a centralized data lake for retrospective hunting
Alert on Chrome update failures or version drift on managed endpoints
Track visits to newly registered or low-reputation domains that could serve exploit content

How to Mitigate CVE-2026-17738

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after deploying the update to ensure the patched binary is loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) for downstream patch availability and apply corresponding updates

Patch Information

Google released the fix in the Stable channel update for Chrome 151. Enterprise administrators should confirm rollout through Chrome Browser Cloud Management or Group Policy. Full details are available in the Chrome Blog Update.

Workarounds

Restrict access to untrusted or unnecessary websites through web filtering while patching is in progress
Disable or restrict the Payment Request API surface via enterprise browser policy where business use permits
Enforce site isolation and keep hardware-based sandboxing features enabled to raise the cost of chained exploits

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version