Loading vulnerability…
Google Chrome Compositing Use-After-Free Sandbox Escape
CVE-2026-17650 is a use-after-free vulnerability in the Compositing component of Google Chrome affecting versions before 151.0.7922.72. A remote attacker who has already compromised the renderer process can potentially exploit the vulnerability through a crafted HTML page to escape the browser sandbox. Chromium classifies the vulnerability as Critical. The specific vulnerable function and memory-lifetime failure are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can potentially bypass the renderer sandbox, extending an existing renderer compromise beyond its isolation boundary. The specific execution privileges and resources accessible after escape are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, restrict access to untrusted web content through URL and DNS filtering, enforce least privilege, and enable available exploit protections. These measures reduce exposure or potential impact but do not correct the use-after-free vulnerability.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.72 or a later vendor-supported release. For Linux, the announced fixed Chrome release is 151.0.7922.71. For Debian stable (trixie), upgrade Chromium to 151.0.7922.71-1~deb13u1 or later. Use the applicable vendor or distribution security update rather than comparing package versions across platforms.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.