Loading vulnerability…
Sandboxed Code Execution via Type Confusion in Google Chrome Turbolev
CVE-2026-126843 is a high-severity type confusion vulnerability in the Turbolev component of Google Chrome versions prior to 157.0.8103.78. A remote attacker can trigger the vulnerability through a crafted HTML page to execute arbitrary code inside the Chrome sandbox. The precise vulnerable function and technical exploitation details are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the Chrome sandbox, compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. The vulnerability does not establish a sandbox escape or full-system compromise.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify that the fixed version is deployed and running across managed devices.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.