CVE-2026-17956: Google Chrome Scheduling RCE Vulnerability

CVE-2026-17956 Overview

CVE-2026-17956 is an inappropriate implementation vulnerability in the Scheduling component of Google Chrome prior to version 151.0.7922.72. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a targeted user. Chromium security engineers rated the underlying issue as Low severity. The flaw affects the Chrome Stable channel across desktop platforms and was addressed in the stable channel update released by Google.

Critical Impact
Successful exploitation permits arbitrary code execution constrained to the Chrome sandbox, providing a foothold that attackers can chain with a sandbox escape to achieve full compromise.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers using affected Scheduling implementations
Downstream distributions consuming the vulnerable Chromium build

Discovery Timeline

2026-07-30 - CVE-2026-17956 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17956

Vulnerability Analysis

The vulnerability resides in Chrome's Scheduling subsystem, which coordinates task execution across renderer processes. An inappropriate implementation in this component allows attacker-controlled HTML to induce behavior that leads to arbitrary code execution within the renderer sandbox. Because the code runs inside the sandbox, direct host compromise is prevented, but attackers gain in-process execution suitable for chaining with a separate sandbox escape.

Details of the specific scheduling logic are tracked in the Chromium Issue Tracker Entry. The remediation ships with the Google Chrome Stable Update.

Root Cause

The root cause is an implementation defect in how the Scheduling component processes tasks originating from web content. Improper handling of scheduled operations creates a condition where crafted markup can steer execution flow. Chromium's advisory does not enumerate the exact primitive, and the Chromium issue remains access-restricted at the time of publication.

Attack Vector

Exploitation requires a target to load a malicious HTML page in a vulnerable Chrome build. Delivery vectors include drive-by downloads, malicious advertisements, compromised websites, and links delivered through phishing. No authentication or user interaction beyond visiting the page is required. Code execution is confined to the sandboxed renderer, so a companion sandbox-escape vulnerability is needed for full system compromise.

// No verified proof-of-concept code is publicly available.
// See the Chromium Issue Tracker Entry for technical details:
// https://issues.chromium.org/issues/517436171

Detection Methods for CVE-2026-17956

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes or making anomalous outbound connections shortly after page load
Browser crash artifacts referencing the Scheduling component on outdated Chrome builds
Traffic to newly registered or low-reputation domains serving heavily obfuscated HTML and JavaScript

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build lower than 151.0.7922.72
Monitor for renderer process anomalies including unexpected memory allocation patterns and cross-process handle requests
Correlate web proxy telemetry with endpoint process telemetry to identify sessions that precede suspicious browser child processes

Monitoring Recommendations

Alert on Chrome auto-update failures that leave endpoints on vulnerable versions
Track process lineage where chrome.exe renderer children invoke shell, scripting, or LOLBins
Ingest browser crash reports into your SIEM to surface repeated faults in scheduling-related modules

How to Mitigate CVE-2026-17956

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop endpoints
Force restart of Chrome after update to ensure the patched binary is active in memory
Validate managed enterprise policies do not pin Chrome to a prior major version

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update. Administrators should confirm rollout through Chrome Browser Cloud Management or equivalent MDM tooling. Chromium-derived browsers should be upgraded once their vendors integrate the corresponding Chromium merge.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patch deployment completes
Enable Chrome Site Isolation and strict Safe Browsing enforcement through group policy
Deploy web content filtering to block newly registered domains and known malicious ad networks

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version