Use-after-free in Google Chrome Portals sandbox escape

Successful exploitation could allow an attacker who already achieved code execution or compromise within the Chrome renderer process to break out of the renderer sandbox. In practical terms, this elevates an attacker from a constrained renderer context to a more privileged context outside the browser sandbox, enabling follow-on compromise of the host or use in multi-stage spyware delivery chains.

If immediate patching is not possible, reduce exposure by limiting use of untrusted web content, isolating high-risk browsing activity, and enforcing rapid browser update policies. Because exploitation requires prior renderer compromise, layered mitigations that reduce initial renderer exploitation risk—such as disabling unnecessary web features where operationally feasible, using site isolation and exploit mitigations provided by the platform/browser, and restricting access to attacker-controlled pages—may reduce likelihood of successful chaining, but patching is the primary mitigation.

Update Google Chrome to version 94.0.4606.61 or later, as the vulnerability affects Chrome prior to 94.0.4606.61. Apply vendor-provided patches across all Chromium-based deployments where applicable and prioritize patching on exposed end-user systems, especially Android-targeted environments referenced in the supplied reporting.