CVE-2026-17950 Overview
CVE-2026-17950 is a vulnerability in the Safe Browsing component of Google Chrome on macOS. Versions of Chrome prior to 151.0.7922.72 contain an inappropriate implementation that allows a remote attacker to execute arbitrary code via a malicious file. Google Chrome addressed the issue in the stable channel release of Chrome 151 for desktop. Chromium rates the security severity as Low, though the impact allows arbitrary code execution when a user interacts with a crafted file. The flaw is specific to the macOS build of Chrome and does not require authenticated access to the target system.
Critical Impact
A remote attacker can trigger arbitrary code execution on macOS systems running Chrome versions earlier than 151.0.7922.72 by delivering a malicious file that bypasses Safe Browsing checks.
Affected Products
- Google Chrome for macOS versions prior to 151.0.7922.72
- Chromium-based builds on macOS incorporating the affected Safe Browsing implementation
- Downstream browsers that share Chromium's Safe Browsing component on macOS
Discovery Timeline
- 2026-07-30 - CVE-2026-17950 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17950
Vulnerability Analysis
The vulnerability resides in Chrome's Safe Browsing subsystem on macOS. Safe Browsing is designed to inspect downloaded files and web resources, warning users when content matches known-bad indicators or exhibits suspicious characteristics. An inappropriate implementation in this component allows a malicious file to reach an execution path it should have been blocked from reaching. The result is arbitrary code execution in the context of the Chrome user on macOS. Google has not published exploitation details, and the Chromium project rates the security severity as Low.
Root Cause
The root cause is an inappropriate implementation within the Safe Browsing code path on macOS. The specific defect is not disclosed in the public advisory. Interested readers can consult the Chromium Issue Tracker Entry once access restrictions are lifted, and the Google Chrome Update Announcement for release notes.
Attack Vector
Exploitation requires an attacker to deliver a malicious file to a victim using an affected Chrome build on macOS. Typical delivery mechanisms include drive-by downloads, phishing links to attacker-controlled hosts, and malicious attachments that redirect through the browser. When Safe Browsing processes the file incorrectly, the attacker's code executes in the browser's user context. No verified proof-of-concept code is publicly available for this CVE.
Detection Methods for CVE-2026-17950
Indicators of Compromise
- Chrome processes on macOS spawning unexpected child processes such as shells, scripting interpreters, or osascript shortly after a download event
- Files written to ~/Downloads or ~/Library/Application Support/Google/Chrome immediately followed by execution attempts
- Outbound connections from Chrome renderer or utility processes to previously unseen domains delivering executable content
Detection Strategies
- Inventory macOS endpoints running Chrome versions earlier than 151.0.7922.72 using endpoint management or software asset tooling
- Correlate browser download telemetry with subsequent process execution events to surface anomalous post-download activity
- Monitor for Chrome process trees that deviate from normal browsing behavior, including unexpected use of macOS binaries such as bash, zsh, or curl
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a centralized analytics platform to enable historical hunting across download and execution events
- Alert on Chrome versions falling behind the current stable channel on macOS assets
- Track network egress from browser processes for connections to low-reputation domains and newly registered infrastructure
How to Mitigate CVE-2026-17950
Immediate Actions Required
- Update Google Chrome on all macOS endpoints to version 151.0.7922.72 or later
- Verify automatic updates are enabled and functioning by checking chrome://settings/help on managed devices
- Restart Chrome after the update installs to ensure the patched binary is loaded
Patch Information
Google addressed CVE-2026-17950 in the stable channel release of Chrome 151.0.7922.72 for desktop. Details are documented in the Google Chrome Update Announcement. Administrators managing Chrome through MDM or enterprise policy should push the updated build to macOS fleets and confirm compliance through reporting.
Workarounds
- Restrict downloads of executable file types at the network perimeter or secure web gateway until affected endpoints are patched
- Enforce application allowlisting on macOS so that only signed, approved binaries can execute
- Advise users to avoid opening files from untrusted sources until Chrome is updated on their device
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
