CVE-2026-17893: Google Chrome RCE Vulnerability on macOS

CVE-2026-17893 Overview

CVE-2026-17893 is an input validation vulnerability [CWE-20] in the Updater component of Google Chrome on macOS. Versions of Chrome prior to 151.0.7922.72 fail to properly validate untrusted input handled by the Updater. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium project rated the security severity as Medium.

Critical Impact
Successful exploitation enables a sandbox escape from a compromised renderer, allowing attacker-controlled code to interact with the host macOS environment beyond Chrome's sandbox boundary.

Affected Products

Google Chrome for macOS versions prior to 151.0.7922.72
Chromium-based builds on macOS that share the vulnerable Updater code path
Downstream browsers using the affected Chromium Updater component on macOS

Discovery Timeline

2026-07-30 - CVE-2026-17893 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17893

Vulnerability Analysis

The flaw resides in the Chrome Updater component on macOS. The Updater accepts input that originates from lower-privileged browser contexts without sufficient validation. When the renderer process is already under attacker control, the attacker can shape input that the Updater consumes and acts upon. This crosses a trust boundary that the Chrome sandbox is designed to enforce, enabling code or actions to execute outside the renderer's confinement.

The vulnerability is categorized as improper input validation [CWE-20]. Exploitation requires a prior renderer compromise, typically achieved through a separate memory-safety or logic bug reachable from a malicious web page. Chained together, the two flaws move an attacker from JavaScript execution inside a tab to code running in a more privileged process context on macOS.

Root Cause

The Updater on macOS does not adequately verify untrusted input received across process boundaries. Data that should be treated as attacker-controlled after a renderer compromise is processed as trusted, allowing the Updater to be manipulated into performing operations that bypass sandbox restrictions.

Attack Vector

The attack begins with a crafted HTML page that triggers a renderer-side vulnerability. Once the renderer is compromised, the attacker sends malformed or unexpected input to the Updater component. The Updater processes this input without proper validation, producing behavior that facilitates a sandbox escape on macOS.

No verified public exploit code is available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for the vendor's technical details.

Detection Methods for CVE-2026-17893

Indicators of Compromise

Chrome installations on macOS reporting a version earlier than 151.0.7922.72 in fleet inventory data
Unexpected child processes spawned by the Google Chrome Updater (GoogleUpdater, ksadmin) outside of scheduled update windows
Anomalous inter-process communication between renderer helper processes and the Updater component

Detection Strategies

Inventory browser versions across managed macOS endpoints and flag any Chrome build below 151.0.7922.72.
Alert on Chrome renderer helper processes writing to or invoking Updater binaries and launchd plists associated with com.google.keystone.
Correlate browser exploitation indicators (renderer crashes, unusual JIT allocations) with subsequent Updater activity to identify chained exploitation attempts.

Monitoring Recommendations

Collect endpoint process telemetry on macOS, including parent-child process lineage for Chrome and its helper processes.
Monitor filesystem changes under ~/Library/Google/GoogleUpdater/ and /Library/Google/GoogleSoftwareUpdate/ for unexpected modifications.
Track outbound network connections from Updater processes that do not match known Google update endpoints.

How to Mitigate CVE-2026-17893

Immediate Actions Required

Update Google Chrome on macOS to version 151.0.7922.72 or later on all managed endpoints.
Force-close and relaunch Chrome after the update to ensure the patched Updater component is loaded.
Audit macOS fleet inventory to confirm no legacy Chrome installations remain reachable.

Patch Information

Google addressed the vulnerability in Chrome for macOS 151.0.7922.72. See the Google Chrome Desktop Update release notes for the corresponding stable channel announcement and the Chromium Issue Tracker Entry for issue-level context.

Workarounds

Restrict browsing to trusted sites until the patch is deployed, reducing exposure to malicious HTML pages that could compromise the renderer.
Enforce automatic Chrome updates through macOS device management policies so the fixed Updater rolls out without user intervention.
Consider temporarily deploying an alternate browser for high-risk users if the patched version cannot be applied immediately.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Trigger an on-demand update via the Google Updater (ksadmin)
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin \
  --prod com.google.Chrome \
  --print-tag