CVE-2026-17776

Analyzed Analyzed - Analysis Complete

Chrome Policy Bypass in Receiver Sandbox Escape

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: Chrome

Description

Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17776

EUVD

EUVD-2026-50725

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is a policy bypass in Google Chrome's Receiver component. It allows an attacker who has already compromised the renderer process to potentially escape the sandbox and perform unauthorized actions via a specially crafted HTML page.

Detection Guidance

Detection requires checking the installed version of Google Chrome. If your version is prior to 151.0.7922.72, the system is vulnerable. Use commands like 'google-chrome --version' or check via package manager (e.g., 'apt list --installed | grep chrome' on Debian/Ubuntu).

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code outside the browser's sandbox, potentially accessing sensitive data or performing actions on your system with the same permissions as the browser.

Compliance Impact

This vulnerability involves a policy bypass in Google Chrome's Receiver component, enabling a sandbox escape via a crafted HTML page. Such a flaw could potentially allow unauthorized access to sensitive data, which may impact compliance with GDPR (data protection) and HIPAA (health information privacy) by increasing the risk of data breaches or unauthorized disclosures.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the policy bypass vulnerability in the Receiver component.

Hi! I’m here to help you understand CVE-2026-17776. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70