Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer p…

CVE-2026-17987 describes a vulnerability in Google Chrome's Notifications component where insufficient validation of untrusted input allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox. The attack vector involves a crafted PDF file. The vulnerability affects Google Chrome versions prior to 151.0.7922.72. Google has addressed the issue in the stable channel update released for desktop. Chromium's internal severity rating is 'Low', though the sandbox escape potential elevates its practical risk. The flaw is classified as insufficient input validation, a common but impactful class of vulnerability. Exploitation requires a pre-compromised renderer process, making it a chained exploit scenario. The fix is available in Chrome 151.0.7922.72 and later.