CVE-2026-17924: Google Chrome DNS Use After Free Flaw

CVE-2026-17924 Overview

CVE-2026-17924 is a use-after-free vulnerability [CWE-416] in the Domain Name System (DNS) component of Google Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage this flaw to potentially escape the Chromium sandbox using a crafted HTML page. Chromium rated the security severity as Low, reflecting the prerequisite of a prior renderer compromise. The vulnerability affects the desktop Stable channel and was addressed in the Chrome Stable channel update published on the Chrome Releases blog.

Critical Impact
Successful exploitation chained with a renderer compromise can break out of the Chromium sandbox, granting the attacker the privileges of the browser process on the host.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating vulnerable Chrome DNS code paths
Downstream distributions bundling pre-151.0.7922.72 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17924 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17924

Vulnerability Analysis

The flaw is a use-after-free condition in Chrome's DNS handling code. Use-after-free bugs occur when a program continues to reference memory after it has been released back to the allocator. An attacker who reallocates that freed region with attacker-controlled data can influence subsequent operations on the dangling pointer. In this case, the DNS subsystem runs in a privileged browser-process context, so corrupting its state can allow logic that normally lives outside the sandboxed renderer to be manipulated.

Exploitation requires the attacker to already control the renderer process, typically via a separate memory-corruption or type-confusion bug reached through a crafted HTML page. Once the renderer is compromised, the attacker triggers DNS-related interprocess communication (IPC) that exercises the vulnerable code path, then races or grooms the browser-process heap to reuse the freed object. Successful reuse yields a sandbox escape from the renderer to the browser process.

Root Cause

The root cause is improper lifetime management of a DNS object referenced across asynchronous callbacks. When the object is destroyed while a pending operation still holds a raw pointer to it, the subsequent operation dereferences freed memory. See the Chromium Issue Tracker entry for tracking details.

Attack Vector

The attack chain is browser-to-host escalation. A victim visits a malicious page, the page exploits a separate renderer bug to gain code execution inside the sandboxed renderer, then issues crafted DNS IPC messages to trigger the use-after-free in the browser process and escape the sandbox.

No verified public proof-of-concept is available. Refer to the
[Chromium Issue Tracker entry](https://issues.chromium.org/issues/513714124)
for technical details once the bug report is opened to the public.

Detection Methods for CVE-2026-17924

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on Linux and macOS hosts.
Unusual outbound DNS queries generated by the Chrome browser process rather than the network service utility process.
Chrome renderer or browser process crashes with heap-corruption signatures preceding suspicious host activity.

Detection Strategies

Inventory Chrome versions across the fleet and alert on any endpoint running a build older than 151.0.7922.72.
Monitor for anomalous parent-child process relationships originating from chrome.exe or the Chrome browser binary on macOS and Linux.
Correlate Chrome crash telemetry with subsequent process creation or file-write events on the same host.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and build queries that flag out-of-date Chrome installations.
Track EDR process-lineage events where Chrome spawns non-standard binaries, and route them to the SOC queue for review.
Review the Chrome Stable channel update announcement and subscribe to Chrome Releases for future advisories.

How to Mitigate CVE-2026-17924

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded into memory.
Push the update through enterprise management tooling (Chrome Browser Cloud Management, Intune, Jamf, or equivalent) to guarantee coverage.

Patch Information

Google released the fix in Chrome Stable 151.0.7922.72 for desktop. Details are published in the Chrome Releases stable channel update. Chromium-derivative browsers must pick up the corresponding upstream commit before they are considered patched.

Workarounds

No vendor-approved workaround exists; applying the Chrome update is the supported remediation.
Restrict browsing to trusted sites via enterprise policy until patching is complete to reduce exposure to crafted HTML pages.
Enforce site isolation and the sandbox by keeping default Chrome security flags enabled across managed installs.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion