Use-after-free in Google Chrome Compositing sandbox escape

Successful exploitation can allow an attacker to break out of the browser sandbox after achieving renderer-process compromise. This can expand the attacker’s control beyond the renderer security boundary and may result in high-impact compromise of confidentiality, integrity, and availability on the affected system. Depending on follow-on exploitation, this can enable broader code execution and system compromise than a renderer-only foothold would permit.

Until patching is complete, reduce exposure by limiting use of untrusted web content, enforcing browser isolation or application sandboxing controls external to Chrome where available, and restricting high-risk browsing activity on sensitive systems. Enterprise defenders should prioritize rapid rollout of the fixed browser version and verify successful restart and version adoption across endpoints. Because exploitation requires renderer compromise, layered controls that reduce browser exploitability, such as exploit mitigations and least-privilege endpoint configurations, may lower risk but do not replace patching.

Update Google Chrome to version 146.0.7680.178 or later on affected desktop platforms. Organizations should deploy the vendor-provided stable channel update across managed endpoints and ensure browsers are restarted so the patched version is loaded. Any Chromium-based downstream products should also be updated once vendor fixes incorporating the patch are available.