CVE-2026-17922: Google Chrome Enterprise RCE Vulnerability

CVE-2026-17922 Overview

CVE-2026-17922 affects Google Chrome versions prior to 151.0.7922.72. The vulnerability stems from an inappropriate implementation in the Enterprise component of Chrome. A remote attacker can exploit this flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to execute arbitrary code on the victim's system.

Google has rated the Chromium security severity as Low. The issue was addressed in the Chrome Stable channel update tracked in the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry.

Critical Impact
Remote attackers can execute arbitrary code by luring users to a crafted HTML page rendered in a vulnerable Chrome browser.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Enterprise component code
Chrome Enterprise deployments running versions earlier than 151.0.7922.72

Discovery Timeline

2026-07-30 - CVE-2026-17922 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17922

Vulnerability Analysis

CVE-2026-17922 is classified as an inappropriate implementation flaw within the Enterprise component of Google Chrome. Inappropriate implementation issues in Chromium typically involve logic that deviates from expected security assumptions. Attackers can leverage such flaws to bypass enforced restrictions or reach code paths that were not designed for untrusted input.

In this case, a crafted HTML page delivered to a vulnerable browser triggers behavior that leads to arbitrary code execution. The attack requires no elevated privileges on the target system. Chrome's rendering engine processes the malicious page and the flawed Enterprise logic path enables the attacker's payload to run.

Root Cause

The root cause lies in the Enterprise feature area of Chromium, where implementation logic did not sufficiently enforce security boundaries. The exact technical mechanism is tracked in the Chromium Issue Tracker under issue 513611659. Google addressed the flaw by revising the affected implementation in Chrome 151.0.7922.72.

Attack Vector

Exploitation requires a user to visit or be redirected to a page controlled by the attacker. The attack vector is remote and network-based, delivered through standard web traffic. Common delivery methods include phishing links, malvertising, and compromised third-party content embedded in trusted sites. No authentication is required on the target browser for the attack chain to proceed.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for technical details as they become disclosed.

Detection Methods for CVE-2026-17922

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after web navigation
Outbound network connections from Chrome renderer processes to unrecognized or newly registered domains
Presence of Chrome versions earlier than 151.0.7922.72 on managed endpoints

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 151.0.7922.72
Monitor process lineage for anomalous descendants of chrome.exe that suggest a renderer sandbox escape or code execution
Correlate browser telemetry with network egress data to identify sessions that visited suspicious HTML content shortly before anomalous activity

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake to enable retrospective hunting for browser-initiated execution
Alert on Chrome installations that fall out of compliance with the fixed version baseline
Track Chrome Enterprise update deployment status through management consoles and reconcile against endpoint reporting

How to Mitigate CVE-2026-17922

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched binary is loaded
Verify update deployment through Chrome Enterprise policy reporting or endpoint inventory tools

Patch Information

Google released the fix in the Chrome Stable channel as documented in the Google Chrome Stable Update advisory. The fixed version is 151.0.7922.72. Administrators managing Chrome Enterprise should push the update through group policy or the Chrome Browser Cloud Management console.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until the patch is applied
Enable Enhanced Safe Browsing to increase warnings against known malicious pages
Deploy web filtering at the network perimeter to block newly registered or low-reputation domains

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version