CVE-2026-17751: Google Chrome AdFilter RCE Vulnerability

CVE-2026-17751 Overview

CVE-2026-17751 is an inappropriate implementation flaw in the AdFilter component of Google Chrome. Versions of Chrome prior to 151.0.7922.72 are affected. A remote attacker can leverage a crafted HTML page to execute arbitrary code inside the Chrome sandbox. Google classifies the Chromium security severity as Medium.

The vulnerability requires the victim to visit or render an attacker-controlled page. Successful exploitation confines code execution to the sandboxed renderer process, limiting immediate host impact but providing a foothold that can be chained with a sandbox escape.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to any user running a Chrome build earlier than 151.0.7922.72.

Affected Products

Google Chrome versions prior to 151.0.7922.72 (Stable channel, Desktop)
Chromium-based browsers incorporating the same AdFilter implementation
Any deployment that has not yet rolled out the fixed Chrome Stable build

Discovery Timeline

2026-07-30 - CVE-2026-17751 published to the National Vulnerability Database
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-17751

Vulnerability Analysis

The defect resides in Chrome's AdFilter component, which is responsible for evaluating and filtering advertising content within rendered pages. According to Google's advisory, the component contains an inappropriate implementation that permits a crafted HTML page to trigger arbitrary code execution inside the browser sandbox.

Because execution occurs inside the sandbox, an attacker does not immediately gain host-level code execution. However, sandboxed renderer compromise is a well-established starting point for full browser exploitation when combined with a secondary sandbox escape. The flaw is reachable over the network with no privileges required beyond visiting a malicious page.

Additional technical detail is tracked in the Chromium Issue Tracker Entry and the Google Blog Post on Update.

Root Cause

Google attributes the issue to an "inappropriate implementation" within AdFilter. The public advisory does not disclose the specific code path or memory safety class involved. No CWE has been assigned in the NVD entry at the time of publication.

Attack Vector

Exploitation is remote and web-based. An attacker hosts a crafted HTML page and induces a Chrome user to load it directly, through an iframe, or via a malicious advertisement served on an otherwise legitimate site. User interaction is limited to normal browsing.

No verified proof-of-concept or exploit code is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17751

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes or performing anomalous file and network activity after rendering third-party ad content
Outbound connections from Chrome to newly registered or low-reputation domains hosting HTML content with unusual ad-filtering payloads
Browser telemetry showing Chrome versions earlier than 151.0.7922.72 still active in the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 151.0.7922.72 for prioritized patching.
Monitor for renderer process behavior that deviates from baseline, such as unexpected memory allocations, code injection attempts, or attempts to access sensitive local resources.
Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious ad-serving domains prior to any anomalous browser activity.

Monitoring Recommendations

Enable browser process telemetry ingestion into your SIEM or data lake to retain renderer-child process relationships for retrospective hunting.
Track Chrome auto-update health and generate alerts when endpoints fall behind the current Stable channel build.
Watch for follow-on activity consistent with sandbox escape attempts, such as unexpected privileged process creation immediately after browser activity.

How to Mitigate CVE-2026-17751

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Desktop platforms via the Stable channel.
Force a browser restart after update deployment to ensure the patched binary is loaded into memory.
Audit Chromium-derivative browsers in the environment and apply vendor updates that incorporate the upstream AdFilter fix.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update announced in the Google Blog Post on Update. The fixed version is 151.0.7922.72. Enterprises managing Chrome through group policy or MDM should push the update and verify installation status.

Workarounds

Restrict browsing to trusted destinations using web filtering or DNS security controls until patching is complete.
Enforce enterprise policies that block third-party advertising networks known to serve unvetted HTML content.
Isolate high-risk browsing sessions in a remote browser isolation service or a dedicated virtual machine while updates are rolled out.

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version