This vulnerability, identified as CVE-2026-17776, is a policy bypass issue in the Receiver component of Google Chrome versions before 151.0.7922.72. It allows a remote attacker, with prior compromise of the renderer process, to potentially perform a sandbox escape by leveraging a crafted HTML page. The Chromium security team rates this vulnerability as medium severity. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. The vulnerability is tracked under CWE-693 (Protection Mechanism Failure).

Successful exploitation could allow an attacker who has already compromised the renderer process to escape the sandbox, potentially increasing their privileges and ability to affect the host system. The impact is rated medium with limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update blog post should be monitored for updates regarding the fix. Until a patch is confirmed, users should exercise caution with untrusted content and consider applying any available Chrome updates promptly once released.