Chrome CVE-2026-5290

Requires Google Chrome versions prior to 146.0.7680.178. Attacker must first compromise the renderer process, then trick the user into opening a crafted HTML page. Sandbox escape enables full system compromise.

This vulnerability carries significant real-world risk despite the high barrier to exploitation (prior renderer compromise required). The Chromium security severity is rated High, and the vulnerability represents a sandbox escape-one of the most critical attack chains in browser security. The use-after-free defect (CWE-416) is exploitable for memory corruption and code execution. While exploitation requires an attacker to first compromise the renderer process (e.g., via a separate RCE in JavaScript engine or WebAssembly), once achieved, this vulnerability becomes a second-stage payload that elevates privileges beyond the sandbox, potentially granting access to browser cookies, local files, and system resources. The fact that a vendor patch is available and deployed in Chrome 146.0.7680.178 suggests the issue was fixed promptly; users on earlier versions face elevated risk, particularly if renderer-process compromises are chained with this sandbox escape in advanced attack campaigns.

An attacker first compromises the Chrome renderer process through a separate vulnerability (such as a JavaScript engine RCE or WebAssembly exploit), gaining code execution within the sandboxed renderer. The attacker then loads a malicious HTML page that triggers the use-after-free in the compositing subsystem, causing memory corruption that allows them to overwrite critical data structures or gain control of the renderer's execution flow. By leveraging this compositing bypass, the attacker escapes the renderer sandbox and executes arbitrary code in the browser process or with higher privileges, enabling theft of session cookies, local data exfiltration, or lateral movement to compromise the host system. This attack chain represents an advanced exploit scenario typical of targeted attacks against high-value targets.