Loading vulnerability…
Use-after-free in Google Chrome Views enabling potential sandbox escape
CVE-2026-17652 is a use-after-free vulnerability in the Views component of Google Chrome before version 151.0.7922.72. A remote attacker who has already compromised the renderer process could potentially exploit the flaw through a crafted HTML page to escape the browser sandbox. The specific vulnerable function and detailed exploitation mechanics are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow an attacker to escape the renderer sandbox, enabling further compromise beyond the renderer process. Specific confidentiality, integrity, and availability consequences attributable to this vulnerability are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Pending patch deployment, defense-in-depth measures include running browser users without administrative rights, enforcing least privilege, enabling exploit protection, and restricting untrusted web content and browser extensions. These measures do not replace the security update.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.72 or later. Platform-specific Chrome security updates also identify version 151.0.7922.71 for Linux and versions 151.0.7922.71/.72 for Windows and macOS. For Debian Chromium, upgrade to 151.0.7922.71-1~deb13u1 on Debian trixie; the Debian 12 package recommendation is 151.0.7922.71-1~deb12u1 or later. Use the fixed package appropriate to the installed platform and distribution.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.