CVE-2026-17919: Google Chrome Privilege Escalation Flaw

CVE-2026-17919 Overview

CVE-2026-17919 is an insufficient policy enforcement vulnerability in the Enterprise component of Google Chrome on macOS. Versions prior to 151.0.7922.72 fail to properly enforce enterprise security policies. An attacker with physical access to the device can leverage this weakness to perform privilege escalation. Chromium security engineers assigned this issue a Low severity rating internally, while the NVD published CVSS score reflects a higher impact profile due to the loss of confidentiality, integrity, and availability. The vulnerability is tracked under [CWE-693: Protection Mechanism Failure].

Critical Impact
A local attacker with physical access to a macOS device running a vulnerable Chrome build can bypass enterprise policy controls and escalate privileges on the host.

Affected Products

Google Chrome for macOS prior to 151.0.7922.72
Chrome Enterprise deployments on macOS endpoints
Managed Chrome installations relying on enterprise policy enforcement

Discovery Timeline

2026-07-30 - CVE-2026-17919 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17919

Vulnerability Analysis

The flaw resides in the Enterprise policy enforcement subsystem of Google Chrome on macOS. Chrome relies on managed policies to constrain browser behavior on enterprise-controlled endpoints. These policies define restrictions on extensions, URL access, developer tooling, and integration with the operating system. When policy enforcement is insufficient, expected restrictions do not apply consistently at runtime.

An attacker who obtains physical access to an unlocked or accessible macOS device can interact with Chrome in ways that were intended to be blocked by administrative policy. Because Chrome runs in the context of the logged-in user and can invoke helper processes on macOS, gaps in policy enforcement translate into elevated capability on the host. The result is privilege escalation beyond what the enterprise configuration intends to permit.

Root Cause

The root cause is a protection mechanism failure [CWE-693] in Chrome's Enterprise policy pathway on macOS. Policy checks that should gate a privileged operation are either missing, bypassable, or applied inconsistently. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor-specific technical context.

Attack Vector

Exploitation requires physical access to the target macOS device. The attacker interacts with the Chrome browser locally to trigger the policy-gated action that is not properly enforced. No network access, no user interaction from a remote party, and no prior authentication are required for the local flow. Successful exploitation results in privilege escalation on the endpoint.

// No verified public exploit code is available for CVE-2026-17919.
// Refer to the Chromium Issue Tracker entry linked above for vendor details.

Detection Methods for CVE-2026-17919

Indicators of Compromise

Chrome for macOS running a version earlier than 151.0.7922.72 on managed endpoints
Unexpected changes to Chrome enterprise policy state or managed preferences on macOS
Local sessions where restricted Chrome actions (extension installs, developer tools, protocol handlers) succeed despite policy
Chrome helper processes spawning unusual child processes on macOS after local interaction

Detection Strategies

Inventory installed Chrome versions across the macOS fleet and flag hosts below 151.0.7922.72
Correlate physical-access signals (console logins, screen unlocks) with Chrome policy state changes
Monitor macOS MCX/managed preference files and Chrome policy directories for tampering
Alert on Chrome-launched processes that deviate from the baseline enforced by enterprise policy

Monitoring Recommendations

Centralize Chrome version telemetry and enterprise policy compliance data in a SIEM
Track local logon events on macOS endpoints, especially outside business hours
Review Chrome chrome://policy reporting from managed endpoints to confirm expected enforcement
Baseline expected Chrome child-process behavior on macOS and alert on deviations

How to Mitigate CVE-2026-17919

Immediate Actions Required

Update Google Chrome on all macOS endpoints to 151.0.7922.72 or later
Verify enterprise policy delivery to macOS devices using chrome://policy on a sample of hosts
Restrict physical access to managed macOS devices and enforce screen lock timeouts
Confirm FileVault and firmware password protections are enabled on portable macOS assets

Patch Information

Google addressed CVE-2026-17919 in Chrome 151.0.7922.72 for macOS. Administrators should deploy the update through their standard software distribution channel. Details are available in the Google Chrome Desktop Update release notes and the Chromium Issue Tracker Entry.

Workarounds

Enforce full-disk encryption and short auto-lock intervals to reduce physical-access exposure
Limit administrative rights on managed macOS devices to reduce post-escalation impact
Apply MDM configuration profiles that harden Chrome and validate policy enforcement
Where feasible, restrict Chrome usage on shared or kiosk macOS devices until patched

bash

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example MDM query to inventory Chrome versions via osquery
osqueryi "SELECT name, bundle_short_version FROM apps WHERE name = 'Google Chrome.app';"