CVE-2026-17776 describes a policy bypass vulnerability in the Receiver component of Google Chrome before version 151.0.7922.72. An attacker with control over the renderer process could leverage this vulnerability to perform a sandbox escape via a specially crafted HTML page. This could undermine the browser's security model by allowing code execution outside the sandboxed environment. The Chromium security team rates this vulnerability as medium severity. No CVSS score or detailed patch information is currently available.

The vulnerability enables a remote attacker who has compromised the renderer process to potentially escape the sandbox, which could lead to execution of code with higher privileges than intended by the sandbox. This undermines the security isolation provided by Chrome's sandboxing mechanism, increasing the risk of further system compromise. However, exploitation requires prior compromise of the renderer process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Google Chrome security advisories for updates and apply the official fix once it is released. Until a patch is available, limiting exposure to untrusted content and maintaining updated security controls may reduce risk.