The vulnerability CVE-2026-17991 affects Google Chrome versions prior to 151.0.7922.72 and is caused by insufficient validation of untrusted input in the AI subsystem. This weakness allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape by delivering a crafted HTML page. The sandbox escape could lead to full system compromise due to the elevated privileges gained. The CVSS v3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory link is provided but does not explicitly state patch or remediation details in the input data. The affected version listed is 151.0.7922.72, implying the fix is included in this version.

Successful exploitation allows a remote attacker who has compromised the renderer process to escape the sandbox environment, potentially leading to full system compromise. The impact affects confidentiality, integrity, and availability at a high level. This could enable execution of arbitrary code with elevated privileges outside the browser sandbox.

The vulnerability is fixed in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the issue. There is no indication from the vendor advisory that additional mitigations or workarounds are required. Patch status is inferred from the affected version data; verify with the official Google Chrome release notes for confirmation.