CVE-2026-17711 is a race condition vulnerability in the Downloads feature of Google Chrome on Mac systems before version 151.0.7922.72. An attacker who has already compromised the renderer process can exploit this race condition by delivering a specially crafted HTML page to perform a sandbox escape, potentially gaining elevated privileges or executing arbitrary code outside the browser sandbox. The vulnerability is rated critical with a CVSS 3.1 score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. The vendor advisory is available at the official Chrome Releases blog, but no explicit patch or remediation level is stated in the provided data.

Successful exploitation of this vulnerability allows an attacker who has compromised the renderer process to escape the sandbox, potentially leading to arbitrary code execution with higher privileges on the host system. This compromises the security boundaries enforced by the browser sandbox, impacting confidentiality, integrity, and availability of the affected system.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. Check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for the latest remediation guidance.