Loading vulnerability…
Use-after-free in Google Chrome Views enabling sandbox escape
CVE-2026-19172 is a critical use-after-free vulnerability in the Views user-interface component of Google Chrome before version 151.0.7922.109. A remote attacker who has already compromised the renderer process could trigger the vulnerability through a crafted HTML page and potentially escape the renderer sandbox. The specific vulnerable function and detailed exploitation mechanism are not publicly identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could breach the isolation boundary of an already-compromised renderer process, potentially enabling further code execution or privilege escalation outside the renderer sandbox. This vulnerability is not described as a standalone initial renderer compromise. No in-the-wild exploitation was confirmed at the time of the advisory.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict access to untrusted web content, apply URL and DNS filtering, enable available exploit-protection features, and enforce least privilege by avoiding browser use under administrative accounts. These measures reduce exposure or potential impact but do not fix the vulnerability.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.109 or later, restart the browser to activate the update, and verify deployment across managed endpoints. For Debian 13 (trixie), install the Chromium security update to version 151.0.7922.108-1~deb13u1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.