CVE-2026-10908: Chrome FullScreen Use-After-Free Sandbox Escape on Windows

Technical summary

CVE-2026-10908 is a use-after-free vulnerability (CWE-416) in the FullScreen component of Chromium-based Google Chrome running on Windows. The vulnerability exists in versions prior to 149.0.7827.53. An attacker with a compromised renderer process can craft a malicious HTML page that references a freed memory object, leading to memory corruption. This memory corruption can be leveraged to achieve a sandbox escape, allowing code execution in the host Windows context rather than within Chrome's restricted sandbox environment.

Business impact

Sandbox escape vulnerabilities are strategically significant because they transform a browser compromise into a full system compromise. If an attacker tricks a user into visiting a malicious website via phishing or drive-by download, and Chrome is already vulnerable, the attacker gains OS-level code execution. This enables credential theft, malware installation, lateral movement within corporate networks, and persistence mechanisms. For organizations, this means endpoint protection must assume modern browsers are a critical attack surface.

Affected systems

Google Chrome versions prior to 149.0.7827.53 running on Microsoft Windows are affected. Desktop and laptop systems running vulnerable Chrome builds are at risk. Chromium-based derivatives (Edge, Brave, Opera, etc.) may also be affected depending on their patching timeline and version alignment with the upstream Chromium fix. Verify your specific browser version and derivative's patch status through their respective security advisories.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised, typically via a separate web-based exploit or vulnerability, and (2) the user must visit or be directed to a crafted HTML page. The CVSS vector reflects high complexity (AC:H) due to sandbox escape exploitation difficulty, but the user interaction requirement (UI:R) is met through standard web navigation. Active exploitation in the wild has not been confirmed in the KEV database as of the latest update, but the attack chain is feasible for well-resourced threat actors.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Use Chrome's built-in auto-update feature or manually check Settings > About Google Chrome to verify the latest version is installed. For organizations, enforce automated Chrome updates via Windows Group Policy (for managed deployments) or mobile device management (MDM) policies. Additionally, consider defense-in-depth: keep Windows and all software updated, deploy browser isolation technology for high-risk users, and maintain endpoint detection and response (EDR) tools to catch initial renderer exploits before sandbox escape is attempted.

Patch guidance

Google Chrome 149.0.7827.53 and later contain the fix. Verify your Chrome version in Settings > About Google Chrome—this will show your current version and auto-download available updates. For enterprise deployments using Google Chrome Enterprise, configure the Chrome Update policies to enforce installation. Test patches in a non-production environment first if you manage centralized Chrome instances. Chromium-based browsers (Microsoft Edge, Brave, Opera) should check their official security advisories for corresponding patch versions, as they may lag upstream Chromium releases.

Detection guidance

Monitor Chrome crash reports and renderer process termination events; exploitation attempts may trigger memory protection exceptions before sandbox escape succeeds. EDR solutions should flag unusual child process creation from chrome.exe, especially processes spawning with SYSTEM or elevated privileges. Web proxy logs and DNS records can help identify malicious domains hosting exploit pages. Inspect browser extension and plugin install events for suspicious additions post-breach. Correlate renderer exploitation signatures (if available in your EDR vendor's ruleset) with successful sandbox escape indicators such as unexpected Windows API calls from Chrome processes or creation of persistence mechanisms.

Why prioritize this

This vulnerability earns HIGH priority because sandbox escape in a widely deployed, always-on application (Chrome) amplifies impact significantly. A single successful exploit grants an attacker OS-level persistence and lateral movement capability. Although active exploitation is not yet confirmed in public KEV records, threat actors routinely chain browser exploits with sandbox bypasses in targeted campaigns. Organizations should prioritize patching within their standard browser update cycle, typically 1–2 weeks, and accelerate for high-risk user groups (executives, developers, security staff).

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the confluence of network attack vector (AV:N), high complexity due to sandbox escape difficulty (AC:H), no privilege requirement to visit a web page (PR:N), required user interaction to click a link (UI:R), changed scope to impact system and network (S:C), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) once exploitation succeeds. The score appropriately emphasizes the privilege escalation and system-wide implications of a successful sandbox break, balanced by the requirement for an attacker to first compromise the renderer process via a separate vulnerability.

Frequently asked questions