This vulnerability involves an out-of-bounds read in the Media component of Google Chrome on Mac platforms before version 151.0.7922.72. An attacker with control over the renderer process could exploit this flaw via a specially crafted HTML page to potentially perform a sandbox escape, which could lead to further compromise of the system. The issue was assigned CVE-2026-17770 and is rated medium severity by Chromium security. The CVSS v3.1 base score is 5.8, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker who has already compromised the renderer process to escape the sandbox environment, potentially increasing their control over the host system. The impact on confidentiality, integrity, and availability is rated low, but the sandbox escape capability can facilitate further attacks.

A fixed version of Google Chrome is available: version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html confirms the availability of this update. No additional mitigation steps are specified.