Loading vulnerability…
Google Chrome Media Use-After-Free Sandbox Escape on Windows
CVE-2026-19163 is a use-after-free vulnerability in the Media component of Google Chrome on Windows before version 151.0.7922.109. A remote attacker who has already compromised the renderer process could potentially exploit the flaw through a crafted HTML page to escape the renderer sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and memory-lifetime failure details are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could breach the renderer sandbox boundary, allowing attacker-controlled execution outside the renderer's confinement and increasing control over the affected system. The vulnerability is a potential post-renderer-compromise escalation mechanism, rather than a standalone initial compromise. The precise execution privileges obtained are not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until patching is complete, restrict access to untrusted web content, enable available exploit-protection features, and enforce least privilege by running browser users without administrative rights. These defense-in-depth measures do not replace the security update.
Patch, then assume compromise.
Upgrade Google Chrome on Windows to version 151.0.7922.109 or later. Restart Chrome to activate the update and verify the installed version across managed endpoints.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.