CVE-2026-10001: Chrome Sandbox Escape via PerformanceManager Use-After-Free

Technical summary

CVE-2026-10001 is a use-after-free vulnerability (CWE-416) in the PerformanceManager component of Google Chrome. The flaw exists in versions prior to 148.0.7778.216. An attacker with renderer-process compromise can trigger the vulnerability through a malicious HTML page to potentially escape Chrome's security sandbox. The CVSS 3.1 score of 8.3 reflects the high severity due to the attack's potential to achieve arbitrary code execution with system-level privileges, though the attack requires both renderer compromise and user interaction.

Business impact

Successful exploitation could allow attackers to break out of Chrome's sandbox and gain unauthorized access to the underlying operating system. Organizations relying on Chrome as a security boundary for untrusted content face elevated risk. The impact spans confidentiality, integrity, and availability of affected systems. However, the attack requires a prior compromise of the renderer process, limiting the immediate threat surface to scenarios where other browser vulnerabilities or social engineering have already granted initial access.

Affected systems

Google Chrome versions prior to 148.0.7778.216 are vulnerable on all supported platforms: Windows, macOS, and Linux systems running vulnerable Chrome instances. The vulnerability is not specific to a particular OS; any user of affected Chrome versions is at risk when visiting a malicious site after the renderer process has been compromised.

Exploitability

While the underlying flaw is a known memory-safety weakness, exploitation requires two preconditions: (1) prior compromise of Chrome's renderer process, and (2) user interaction to load a crafted HTML page. The CVSS vector (AC:H, PR:N, UI:R, S:C) reflects these constraints. The vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation in the wild has not been widely documented at publication, though this does not eliminate the risk to organizations facing targeted attacks.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. This patch version addresses the use-after-free condition in PerformanceManager. Users should enable automatic updates to ensure timely patching. For organizations managing Chrome deployments, coordinate enterprise updates through your standard patch management process to minimize exposure windows.

Patch guidance

Verify and apply Chrome version 148.0.7778.216 or newer across all affected systems. Check your current version via chrome://version/ in the address bar. On Windows and macOS, Chrome typically updates automatically in the background and requires a browser restart to activate; monitor for pending updates in the settings menu. On Linux, use your distribution's package manager or the official Chrome repository. For enterprise deployments, validate patch deployment across your fleet before closing this ticket. Test patched systems against your application portfolio to confirm compatibility.

Detection guidance

Monitor for browser crashes or unexpected terminations of Chrome processes, particularly those involving PerformanceManager operations. Endpoint detection systems should flag unusual process spawning or privilege escalation attempts originating from Chrome processes. Network teams can monitor for suspicious HTML or script traffic patterns targeting known browser vulnerabilities. Log Chrome's browser history for anomalous navigation to malicious or unexpected domains. In high-security environments, restrict renderer-process access through sandbox policies and enforce the principle of least privilege for Chrome execution contexts.

Why prioritize this

Despite the sandbox-escape nature and high CVSS score, this vulnerability's real-world priority is moderated by the requirement for prior renderer compromise. Prioritize patching based on your exposure: (1) highest priority for users visiting untrusted websites or those facing sophisticated targeted attacks, (2) medium priority for general corporate users in lower-risk environments. The absence from CISA's KEV list suggests limited active exploitation to date, but organizations should not interpret this as license to delay—targeted campaigns could emerge quickly.

Risk score, explained

The CVSS 8.3 (HIGH) reflects a severe vulnerability with high impact potential (confidentiality, integrity, and availability all rated H). The score is tempered by moderate attack complexity (AC:H) and the requirement for user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component—this is the sandbox-escape aspect. While the attack vector is network-based and requires no privileges, the cumulative effect of these factors yields a score in the upper-HIGH band, warranting urgent but not emergency response.

Frequently asked questions