Loading vulnerability…
Sandboxed Memory Disclosure in Google Chrome V8
CVE-2026-126891 is a high-severity use-after-free vulnerability in the V8 engine in Google Chrome versions prior to 157.0.8103.78. A remote attacker can trigger access to freed memory through a crafted HTML page, allowing memory disclosure within the browser sandbox. The affected V8 function and detailed triggering conditions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises confidentiality by exposing memory within the Chrome sandbox. Arbitrary code execution, sandbox escape, and integrity or availability impacts are not established for this vulnerability.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. Administrators should verify deployment across managed devices. A fixed Debian Chromium package version is not specified.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.