CVE-2026-17950
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability under discussion represents an inappropriate implementation flaw within Google Chrome's safebrowsing functionality on macOS systems, specifically affecting versions prior to 151.0.7922.72. This issue constitutes a remote code execution vulnerability that could be exploited by malicious actors through the delivery of specially crafted files. The safebrowsing feature is designed to protect users from downloading and executing potentially harmful content by scanning files against known threat databases and implementing various security checks. However, in this instance, the implementation failed to properly validate or handle certain file types, creating a potential attack vector that could be leveraged for arbitrary code execution on affected systems.
The technical nature of this vulnerability stems from insufficient input validation and improper handling of file processing within Chrome's safebrowsing module. When users encounter potentially malicious files, the browser's safebrowsing functionality should act as a protective barrier by analyzing these files and preventing their execution or download. The flaw lies in how Chrome processes certain file attributes or metadata that could be manipulated to bypass security checks. This particular implementation weakness allows an attacker to craft a malicious file that appears benign to the safebrowsing system but contains executable code or instructions that can be triggered upon user interaction or automatic processing by the browser.
From an operational standpoint, this vulnerability poses significant risks to macOS users who rely on Chrome for their browsing activities. The low severity classification from Chromium does not diminish the potential impact, as remote code execution vulnerabilities are inherently dangerous regardless of their assigned severity level. Attackers could exploit this flaw by distributing malicious files through various vectors including phishing emails, compromised websites, or file-sharing platforms. Once executed, the arbitrary code could establish persistence mechanisms, exfiltrate sensitive data, install additional malware, or provide attackers with full control over affected systems. The attack surface is particularly concerning given Chrome's widespread usage and the trust users place in its security features.
The vulnerability aligns with several cybersecurity frameworks including CWE 120 which addresses buffer overflow conditions and CWE 787 which covers out-of-bounds write errors, both of which could manifest through improper input handling within safebrowsing modules. From an ATT&CK framework perspective, this vulnerability could map to techniques such as T1193 for Spearphishing Attachment and T1059 for Command and Scripting Interpreter, as attackers would leverage the compromised browser to execute malicious code. Organizations should prioritize immediate patch deployment to address this vulnerability, as the window of opportunity for exploitation remains open until systems are updated to version 151.0.7922.72 or later. Additionally, network administrators should consider implementing additional security controls such as web application firewalls and enhanced email filtering to reduce the risk of successful exploitation while patches are being deployed across affected systems.