Loading vulnerability…
Sandboxed Code Execution in Google Chrome Accessibility
CVE-2026-126851 is a high-severity use-after-free vulnerability in the Accessibility component of Google Chrome before version 157.0.8103.78. Processing a crafted HTML page can cause access to freed memory, allowing a remote attacker to execute arbitrary code inside the browser sandbox. The specific vulnerable function and memory-lifetime sequence have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within Chrome's sandbox, compromising the confidentiality, integrity, and availability of resources accessible to the affected sandboxed process. This vulnerability alone does not establish a sandbox escape or full-device compromise.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify that the fixed version is running across managed devices rather than assume automatic updates have completed.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.