Loading vulnerability…
Use-after-free in Google Chrome Ozone
CVE-2026-17656 is a use-after-free vulnerability in the Ozone component of Google Chrome affecting versions before 151.0.7922.72. A remote attacker could potentially exploit the flaw through a crafted HTML page to escape the browser sandbox. The precise vulnerable function and memory-lifetime failure are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could potentially bypass the browser sandbox's isolation boundary. Specific resulting capabilities, such as host-level code execution, data access, or privilege escalation, are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, reduce exposure by restricting untrusted web content and unnecessary browser extensions, enabling exploit protection, and enforcing least privilege with non-administrative user accounts. These defense-in-depth measures are not established as preventing exploitation and do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome to 151.0.7922.72 or later. For Debian stable (trixie), upgrade chromium to 151.0.7922.71-1~deb13u1 or later. The Chromium package guidance for Debian 12 identifies 151.0.7922.71-1~deb12u1 or later. Upstream Chrome and distribution package version thresholds differ; use the fixed package appropriate to the installed distribution.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.