CVE Intelligence
Analysis AI-assisted

CVE-2026-9891: Google Chrome Extensions Use-After-Free Enabling Possible Sandbox Escape

CVE-2026-9891 is a use-after-free (CWE-416) in the Extensions component of Google Chrome. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted Chrome extension. The CNA and CISA-ADP both report a CVSS base score of 9, and the vendor rates the Chromium security severity as Critical.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9891 is a use-after-free weakness (CWE-416) in the Extensions component of Google Chrome, published on 2026-05-28. The record states that a remote attacker who had already compromised the renderer process could potentially perform a sandbox escape through a crafted Chrome extension. The vendor rates the Chromium security severity as Critical.

Impact

  • The record describes a potential sandbox escape that requires prior renderer process compromise.
  • The CVSS vector in the record indicates network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality, integrity and availability impact. The base score is 9.
  • The SSVC data in the record lists technical impact as total and automatable as no.

Affected products and versions

  • Google Chrome versions before 148.0.7778.216 are described as affected.
  • The affected list in the record includes a boundary at 148.0.7778.215 and an entry with a self-contradictory range ending and starting at 148.0.7778.216. Exact boundaries should be confirmed against the vendor release notes.

Exploitation status

This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00343 with a percentile of 0.26614, as reported in the record.

Remediation and mitigation

  • Update Google Chrome to 148.0.7778.216 or a later release, as indicated by the vendor release notes.
  • Prioritize updates on endpoints where Chrome is widely used for sensitive work.
  • Restrict extension installation to approved extensions through enterprise browser policy, and remove extensions that are no longer needed.

Detection guidance

  • Inventory Chrome versions across the environment and flag installations older than 148.0.7778.216.
  • Review installed extensions for unexpected, unverified or recently added items.
  • Monitor for unusual browser crashes or renderer process anomalies as general indicators, without treating them as confirmed signatures for this flaw.

Limitations of the available information

  • The record has an empty fixes field. The fixed version 148.0.7778.216 is inferred from the description wording 'prior to 148.0.7778.216'.
  • The affected list contains inconsistent entries, so the exact vulnerable range is not fully confirmed.
  • The linked issue tracker entry is tagged as requiring permissions, so technical details are likely restricted.
  • The EPSS date in the record (2026-10-23) is later than the publication date; it is reported as provided.
  • The record does not state whether other Chromium-based browsers are affected.

Frequently asked questions

What is CVE-2026-9891?

It is a use-after-free vulnerability in the Extensions component of Google Chrome that, according to the record, could allow a sandbox escape after renderer compromise.

Which versions are affected?

The description states that Chrome versions prior to 148.0.7778.216 are affected. The affected list in the record is partly inconsistent, so check the vendor release notes for exact boundaries.

Is this CVE known to be exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.