CVE-2026-10918: Chrome Viz Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-10918 is a use-after-free condition (CWE-416) in the Viz rendering component of Chromium-based browsers. The vulnerability exists in Chrome versions prior to 149.0.7827.53. Exploitation requires two prerequisites: first, a compromised renderer process (likely achieved through a separate vulnerability or attack vector), and second, user interaction with a crafted HTML page. When these conditions are met, the use-after-free allows execution in the context of the Viz process, potentially bypassing Chrome's sandbox isolation. The CVSS 3.1 score of 8.3 reflects the high integrity and confidentiality impact despite the higher exploitation barriers.

Business impact

For enterprise environments, this vulnerability poses a risk in scenarios where attackers combine multiple exploits to achieve sandbox escape. Organizations relying on Chrome as their primary browser, particularly those in high-risk sectors, should treat this as part of a broader defense-in-depth concern. The requirement for renderer compromise means this is primarily relevant to organizations already contending with advanced persistent threats or sophisticated social engineering. However, the potential for privilege escalation once achieved warrants prompt patching, as it could enable lateral movement or unauthorized system access beyond the browser context.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. The vulnerability also impacts Chrome on macOS, Windows, and Linux distributions, since it is inherent to the Chromium codebase. Any Chromium-based browser (Edge, Brave, Opera, etc.) built from the affected Chromium source may similarly be vulnerable; verify with respective vendors for patch availability and timelines. The Linux kernel itself is not directly vulnerable, but systems running Chrome on Linux are affected by the browser vulnerability.

Exploitability

Exploitation is constrained by several factors that reduce immediate risk: the attacker must first compromise the Chrome renderer process through a separate vulnerability or social engineering, the user must actively interact with the malicious page, and the attack must be precisely timed to the vulnerable code path. These requirements place this in the 'moderate' exploitability category despite the high CVSS score. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no active weaponization has been documented at this time. However, capability development is likely among nation-state and advanced criminal groups.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome typically auto-updates, but users should manually verify their version (chrome://settings/help) and force an update if needed. On macOS, Windows, and Linux, the patched version addresses the use-after-free condition in the Viz component. For Chromium-based browsers from other vendors, check their respective security advisories and release notes for the corresponding patched version based on their Chromium branch point.

Patch guidance

Google Chrome will notify users of the available update through its built-in update mechanism. Users should allow the update to install and restart their browser to activate the patch. For enterprise deployments using Chrome Enterprise, update policies through your device management platform (MDM/UEM) or Group Policy on Windows to enforce the minimum version of 149.0.7827.53. Test the patched version in a limited pilot before organization-wide deployment to confirm stability with your web applications and extensions. Verify in chrome://version that you are running build 149.0.7827.53 or higher.

Detection guidance

Monitor Chrome version compliance across your organization using endpoint detection and response (EDR) tools or Mobile Device Management (MDM) solutions to ensure no instances remain below version 149.0.7827.53. Log suspicious renderer process behavior or crashes, particularly if accompanied by unexpected sandbox escape attempts or system-level resource access from the Chrome process. Web content filtering solutions may help prevent delivery of malicious HTML pages, though detection of the specific exploit payload is challenging without detailed indicators of compromise. Focus detection efforts on monitoring for anomalous privilege escalation events originating from browser processes on endpoints running vulnerable Chrome versions.

Why prioritize this

This vulnerability merits high-priority patching due to its CVSS 8.3 score and the potential for sandbox escape, which represents a material privilege escalation threat. While the exploitation prerequisites (renderer compromise + user interaction) reduce immediate risk compared to truly network-adjacent vulnerabilities, the consequence of successful exploitation—breaking out of the browser sandbox—is severe enough to justify rapid remediation. Organizations should treat this as part of their regular patch cycle but not defer other security activities; this is not a zero-day or imminent threat in the wild. Prioritize based on your environment's Chrome deployment scale and risk profile.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: (1) High confidentiality, integrity, and availability impact (C:H/I:H/A:H), as successful exploitation breaks sandbox isolation; (2) Network exploitability (AV:N), as the crafted HTML can be served remotely; (3) Mitigating factors include High Attack Complexity (AC:H) due to the need for renderer process compromise and specific code path conditions, and Required User Interaction (UI:R) for the page visit. The 'Changed Scope' (S:C) component elevates the score because the impact extends beyond the vulnerable component (Viz) to system-level access. The score appropriately captures the severity for an advanced attack scenario but reflects that this is not a simple, one-click exploitation path.

Frequently asked questions