Loading vulnerability…
Google Chrome Compositing Use-After-Free Sandbox Escape
CVE-2026-126904 is a high-severity use-after-free vulnerability in the Compositing component of Google Chrome versions before 157.0.8103.78. A remote attacker who has already compromised a renderer process can trigger the flaw through a crafted HTML page to execute arbitrary code outside the Chrome sandbox. The specific vulnerable function and memory-lifetime sequence are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation breaches the Chrome sandbox boundary and permits arbitrary code execution outside the renderer's confinement, potentially compromising confidentiality, integrity, and availability. The vulnerability does not independently establish initial renderer compromise or execution with administrator or kernel privileges.
Patch, then assume compromise.
Upgrade Google Chrome to version 157.0.8103.78 or later and relaunch the browser to activate the update. The corresponding Stable releases are 157.0.8103.78/.79 for Windows and macOS and 157.0.8103.78 for Linux. Administrators should verify the installed version across managed devices. A fixed Debian Chromium package version is not identified; the Debian package entry lists the issue as unpatched.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.