Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proces…

CVE-2026-17990 is a vulnerability in Google Chrome's WebAuthn component caused by insufficient validation of untrusted input. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox. The attack vector involves a crafted PDF file. Although rated Low severity by Chromium's internal security scale, sandbox escapes carry significant real-world risk as they can lead to full system compromise. The vulnerability was patched in the Chrome stable channel update released in July 2026. Users are advised to update to Chrome 151.0.7922.72 or later to mitigate the risk.