CVE-2026-17774: Google Chrome Use-After-Free Vulnerability

CVE-2026-17774 Overview

CVE-2026-17774 affects Google Chrome versions prior to 151.0.7922.72. The vulnerability resides in the Variations component, which handles Chrome's server-driven feature flag and experiment configuration. Insufficient validation of untrusted input allows an attacker in a privileged network position to trigger heap corruption through malicious network traffic. Chromium classifies this issue at Medium severity, while the NVD assigns a higher score due to the confidentiality, integrity, and availability impact of heap corruption. The weakness is tracked under CWE-20: Improper Input Validation.

Critical Impact
An adjacent-network attacker capable of intercepting or manipulating Chrome's Variations traffic can corrupt heap memory, potentially leading to browser compromise on unpatched clients.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers that consume the upstream Variations code path
Enterprise Chrome deployments that have not applied the Stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-17774 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17774

Vulnerability Analysis

Google Chrome retrieves feature-flag and experiment configuration data through its Variations service. This mechanism deserializes structured seed data received over the network and applies it to runtime feature toggles. The Variations parser in versions prior to 151.0.7922.72 fails to sufficiently validate untrusted fields inside this payload. A crafted response can steer parsing logic into an inconsistent state that corrupts adjacent heap allocations.

Heap corruption in the browser process gives attackers a foothold outside the renderer sandbox. Successful exploitation can degrade browser stability, disclose memory contents, or serve as a stepping stone toward code execution when chained with additional primitives. The issue is reachable without user interaction beyond normal browser use.

Root Cause

The root cause is improper input validation [CWE-20] in the Variations component. Fields sourced from network-delivered seed data are consumed without adequate bounds or type enforcement. When malformed values reach downstream memory operations, the process writes or reads outside intended allocations, producing heap corruption.

Attack Vector

The attack requires an adjacent-network position, meaning the attacker must be able to intercept, redirect, or inject traffic on a network path Chrome trusts for Variations updates. Common scenarios include hostile Wi-Fi, compromised upstream network devices, or on-path adversaries in enterprise environments without TLS pinning enforcement. High attack complexity reflects the timing and traffic-manipulation prerequisites, but no privileges and no user interaction are required.

No verified public exploit code is available. See the Chromium Issue Tracker #513323066 and the Google Chrome Update Announcement for vendor-provided technical context.

Detection Methods for CVE-2026-17774

Indicators of Compromise

Unexpected Chrome browser process crashes referencing heap corruption, HeapCorruption, or Variations-related stack frames in crash telemetry
Chrome connections to Variations endpoints (clientservices.googleapis.com, update.googleapis.com) routed through unexpected intermediaries or terminated by non-Google certificates
Endpoints running Chrome versions below 151.0.7922.72 after the patch release date

Detection Strategies

Inventory Chrome versions across managed endpoints and flag hosts below 151.0.7922.72
Correlate browser crash reports with network events showing anomalous TLS interception or proxy insertion on Variations traffic
Alert on adjacent-network conditions such as rogue DHCP, ARP spoofing, or captive-portal manipulation on segments where corporate browsers operate

Monitoring Recommendations

Ingest browser crash and telemetry logs into a centralized data lake for version and stack-frame correlation
Monitor certificate chains presented for Google update and Variations domains and alert on unexpected issuers
Track outbound TLS to Google update infrastructure from segments where man-in-the-middle risk is elevated, such as guest Wi-Fi bridged to corporate assets

How to Mitigate CVE-2026-17774

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after deployment so the patched binary is loaded into memory
Audit fleet-wide Chrome versions and prioritize remediation for mobile users on untrusted networks

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. Administrators using Chrome Browser Enterprise should deploy 151.0.7922.72 or later through their standard update channel. Chromium-derived browsers should pick up the upstream fix in their next merge cycle.

Workarounds

Enforce VPN or Zero Trust network access for users operating on untrusted Wi-Fi until patching completes
Restrict Chrome egress to Google update and Variations endpoints through inspected, trusted network paths
Where feasible, deploy the ChromeVariations enterprise policy settings to limit exposure to untrusted seed responses

bash

# Verify installed Chrome version on Windows managed endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
mdls -name kMDItemVersion "/Applications/Google Chrome.app"

# Verify installed Chrome version on Linux
google-chrome --version