CVE-2026-17654 in Chrome
Summary
by MITRE • 07/30/2026
Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical race condition flaw within the updater component of Google Chrome on macOS systems prior to version 151.0.7922.72. The issue stems from improper synchronization mechanisms during the update process where the updater fails to adequately validate file permissions and ownership before executing privileged operations. The race condition occurs when a malicious local attacker can manipulate files in the update directory structure, creating a temporal window where the updater process operates with elevated privileges while simultaneously processing user-controlled input. This flaw aligns with CWE-362 which specifically addresses race conditions in concurrent programming environments, particularly those involving privileged operations.
The technical implementation of this vulnerability exploits the timing gap between when the updater checks file permissions and when it actually executes file operations. During this window, an attacker can replace legitimate update files with malicious counterparts that contain code designed to escalate privileges. The macOS environment provides additional attack surface through the updater's interaction with system-level directories and processes that require administrator privileges for modification. This behavior maps directly to ATT&CK technique T1068 which covers local privilege escalation through race conditions in system processes.
The operational impact of this vulnerability is severe as it allows a local attacker with minimal privileges to gain full administrative access to the affected system. Once exploited, the malicious code can execute with elevated permissions, enabling arbitrary file manipulation, process injection, and complete system compromise. The critical severity classification reflects both the ease of exploitation in local environments and the potential for significant damage through privilege escalation. Attackers can leverage this vulnerability without requiring network connectivity or user interaction, making it particularly dangerous in environments where local access is possible.
Mitigation strategies should focus on immediate patch deployment to version 151.0.7922.72 or later, which addresses the synchronization issues in the updater component. Organizations should also implement additional monitoring of update directories and file integrity checks for the Chrome installation. System administrators should consider reducing the privileges of the updater process where possible, though this may impact functionality. Network segmentation and access controls can limit potential exploitation vectors while regular security audits should monitor for unauthorized modifications to system components. The vulnerability demonstrates the importance of proper race condition handling in privileged software components and highlights the need for comprehensive security testing of update mechanisms in browser applications.