Loading vulnerability…
GPU Use-After-Free Sandbox Escape in Google Chrome
CVE-2026-19140 is a use-after-free vulnerability in the GPU component of Google Chrome before version 151.0.7922.109. A remote attacker who has already compromised the renderer process could potentially exploit the flaw through a crafted HTML page to escape the browser sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and memory-lifetime conditions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could breach the sandbox boundary containing a compromised renderer process, potentially enabling further code execution or privilege escalation within the browser context. A standalone path to operating-system administrator privileges is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, reduce exposure to untrusted web content through web filtering and browsing restrictions, enforce least privilege, and enable available exploit-protection features. These measures reduce risk but do not correct the use-after-free flaw.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later and restart the browser to activate the update. For Debian stable (trixie), upgrade the chromium package to version 151.0.7922.108-1~deb13u1 or a later security-fixed package. Verify that updates have been applied across managed devices.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.