Loading vulnerability…
Race Condition in Google Chrome Updater for macOS
CVE-2026-17654 is a critical race condition in the Google Chrome Updater on macOS before version 151.0.7922.72. A local attacker can exploit the updater's handling of a malicious file to obtain OS-level privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local attacker to elevate privileges at the operating-system level on an affected macOS system.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict execution and placement of untrusted files by local users, enforce least privilege, and prevent users from operating with administrative rights where feasible.
Patch, then assume compromise.
Upgrade Google Chrome on macOS to version 151.0.7922.72 or a later vendor-provided release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.