CVE-2026-5290: Google Chrome Use-After-Free in Compositing Enables Sandbox Escape
A use-after-free flaw in the Compositing component of Google Chrome, classified as CWE-416, is described as allowing a remote attacker who had already compromised the renderer process to potentially escape the sandbox through a crafted HTML page. The record gives a CVSS base score of 9.6 and does not list the CVE in the CISA KEV catalogue. The description names 146.0.7680.178 as the version threshold, while the fixes field in the record is empty.
Overview
This record describes a use-after-free weakness in the Compositing component of Google Chrome, classified as CWE-416. According to the description, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The vendor's stable channel update is the main vendor reference in the record.
Impact
- The stated potential consequence is a sandbox escape, and the description conditions it on a prior renderer compromise.
- The CVSS base score in the record is 9.6, which corresponds to a critical rating in the record.
- The SSVC fields in the record show exploitation as none, automatable as no and technical impact as total.
Affected products and versions
The record identifies Google Chrome. The description states that versions prior to 146.0.7680.178 are affected. The affected entries list a range below 146.0.7680.177 and a range that starts at 146.0.7680.178 and ends at 146.0.7680.178. The fixes field is empty, so no separate fixed-version entry is available in the record. Release details can be checked in the Chrome stable channel update.
Exploitation status
The record shows kev listed as false, so no confirmed active exploitation is recorded for this CVE. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.306 percent, with a percentile of 22.2.
Remediation and mitigation
- Update Google Chrome to 146.0.7680.178 or later, which is the threshold named in the description.
- Verify installed builds on managed endpoints, and give priority to browsers that regularly render untrusted web content.
- Keep automatic browser updates enabled and make sure browsers are restarted after an update is applied.
Detection guidance
- Inventory Chrome versions across the fleet and flag builds that are older than the stated threshold.
- Review endpoint telemetry for unexpected behaviour in browser or renderer processes, at a high level.
Limitations of the available information
The issue tracker entry is tagged as requiring permissions, so its contents could not be used. The record offers no technical detail beyond the weakness class and the description. The fixes field is empty, and the record does not state whether the 146.0.7680.177 entry corresponds to a patched build.
Frequently asked questions
Does this CVE require an attacker to first compromise the renderer?
Yes, according to the description. It states that the remote attacker had compromised the renderer process before attempting a sandbox escape.
Which version should I update Google Chrome to?
The description names 146.0.7680.178 as the threshold, so builds at or above that version are outside the stated range. The record does not contain a separate fixed-version field.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.