External risk intelligence

Chrome Save to Drive Sandbox Escape Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17803

The vulnerability resides in a client-side web browser application and requires a user to interact with a crafted PDF file within the application. It is not a network service, gateway, or internet-facing infrastructure component, making it unlikely to be exposed or reachable as a standalone public service.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in Google Chrome's Save to Drive feature could allow an attacker to escape the browser's security sandbox, potentially leading to broader system compromise if a user opens a specially crafted PDF file. While the direct risk is mitigated by the need for user interaction and a compromised renderer process, it's important to confirm if this specific functionality is in use and assess potential exposure.

Input validation flaw in browser feature.
Confirms user interaction vulnerability.
Assess relevance and user exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by compromising the browser's renderer process, which handles web page content. With this access, they could then present a specially crafted PDF file to the user. If the user opens this PDF within Google Chrome, the vulnerability in the "Save to Drive" feature could allow the attacker to break out of the browser's security sandbox.

Requires renderer process compromise.
Triggered by opening a crafted PDF.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape vulnerability in Google Chrome's Save to Drive feature could allow a compromised renderer process to execute code outside its intended sandbox when a user opens a crafted PDF file. This could potentially affect system data and the behavior of the affected service.

System data and service behavior.
Opening a crafted PDF file.
Potential sandbox escape.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's Save to Drive feature impacts end-user devices. The first step is for security teams or IT support to identify Chrome installations, determine user exposure, and coordinate with the vendor or internal application support teams for remediation.

Identify and scope affected Chrome users.
Verify user interaction with crafted PDF files.
Coordinate vendor updates or user guidance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Chrome Save to Drive feature?

Save to Drive is a browser integration that allows users to directly store web content, such as documents or images, into their Google Drive cloud storage. In Google Chrome, this feature handles the processing and transmission of files from the web to your personal or work cloud space.

What does CWE-20 mean for CVE-2026-17803?

CWE-20 refers to Improper Input Validation. In this context, it means the Save to Drive component fails to adequately verify the data received within a PDF file. Because the browser assumes the incoming data is safe, a specially structured PDF can trick the software into performing actions it was not intended to do, which is the root cause of this sandbox escape.

How is this sandbox escape triggered?

An attacker must first compromise the browser's renderer process, which is responsible for displaying web content. Once that process is controlled, they must induce a user to open a specifically crafted PDF file. Simply having the browser installed or visiting a malicious website does not trigger the bug; the user must actively open the malicious file through the affected feature.

Is my device vulnerable to CVE-2026-17803?

According to Halo Surface Signal, this vulnerability is unlikely to be exposed as a standalone public service because it exists within a client-side application. It is not an internet-facing server or gateway. You should consider it relevant if your environment relies on Chrome to handle untrusted PDF documents, as the risk is tied to user interaction with files rather than external network exposure.

What steps should I take to address this issue?

Begin by auditing your environment to identify systems running older versions of Google Chrome. Since the fix involves updating the browser to version 151.0.7922.72 or later, prioritize deploying these updates to all workstations. Coordinate with IT support to ensure that automated update channels are functioning correctly and verify that users are aware of the risks associated with opening PDF files from untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.