Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a san…

CVE-2026-17709 describes a race condition vulnerability in the Downloads component of Google Chrome on macOS. The flaw affects versions prior to 151.0.7922.72 and carries a High severity rating from the Chromium security team. An attacker who has already compromised the renderer process could exploit this race condition to potentially escape the browser sandbox. The attack vector requires the victim to visit a specially crafted HTML page. Sandbox escapes are considered critical in browser security as they allow attackers to break out of the isolated browsing environment and interact with the underlying operating system. Google addressed the issue in the stable channel update released in July 2026. The vulnerability is currently undergoing analysis by NVD.