CVE-2026-9890: Chrome XR Use-After-Free Sandbox Escape (Windows)

Technical summary

CVE-2026-9890 is a use-after-free vulnerability (CWE-416) in the XR module of Google Chrome versions prior to 148.0.7778.216 on Windows. The flaw allows a threat actor controlling the renderer process to craft a malicious HTML page that triggers a memory use-after-free condition. Successful exploitation results in sandbox escape, elevating privileges from the sandboxed renderer context to the operating system. The Chromium project rated this as Critical severity due to its sandbox-escape implications.

Business impact

Sandbox escape vulnerabilities represent a critical elevation in risk because they allow attackers to move from browser context into host operating system control. In an enterprise setting, this could enable attackers who have achieved renderer compromise (via existing web exploits, drive-by downloads, or social engineering) to pivot to stealing credentials, installing persistent malware, exfiltrating sensitive data, or lateral movement across the network. The multi-stage nature means existing web-attack vectors become more dangerous.

Affected systems

Google Chrome on Microsoft Windows is affected in versions prior to 148.0.7778.216. This includes all supported and unsupported Windows versions running vulnerable Chrome releases. The vulnerability does not affect Chrome on macOS, Linux, Android, or iOS, nor does it affect Chromium derivatives that have not ported the vulnerable XR code. Windows users of Chrome are the sole target.

Exploitability

Exploitation requires two preconditions: (1) the attacker must already control the Chrome renderer process, and (2) the victim must visit or be directed to a crafted HTML page while that renderer is compromised. This is not remotely exploitable in isolation; it is a secondary payload delivered after initial renderer compromise. The attack chain complexity is high, but the consequences of successful exploitation are severe. As of the provided data, this vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active in-the-wild exploitation at publication.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Users should enable automatic Chrome updates to receive the fix without manual intervention. Organizations should verify patch deployment across managed Windows systems and consider blocking older Chrome versions via Group Policy or mobile device management if applicable. Until patched, network controls limiting access to untrusted websites reduce—but do not eliminate—risk for users whose renderer is already compromised.

Patch guidance

Google has released Chrome 148.0.7778.216 as the remedial version. Verify this build number against your installed Chrome version by navigating to Chrome menu > Help > About Google Chrome, which will prompt an immediate update check. Enterprise administrators can reference Google's Chrome release notes and deploy updates via their standard patch management channel. No interim workarounds short of disabling XR or sandboxing Chrome further are practical; patching is the required response.

Detection guidance

Monitor Windows event logs and security tools for unusual privilege escalation sequences following Chrome renderer crashes or suspicious page loads. Endpoint detection platforms should flag Chrome processes spawning system-level commands or accessing restricted registry/file paths. Behavioral analysis of XR subsystem activity in Chrome logs (if available) may reveal use-after-free memory corruption patterns. Network detection focusing on delivery of known exploit payloads to XR modules would be challenging without signatures; instead, prioritize patching velocity and renderer process isolation monitoring.

Why prioritize this

Although the CVSS score is 8.3 (HIGH), the Chromium rating of Critical and the sandbox-escape capability elevate real-world priority significantly. This should be treated as critical for Windows environments because it enables attackers to move from web-browser compromise to system compromise. The two-stage nature means it targets users already under attack; prioritizing patch deployment closes a high-value secondary attack vector. Organizations should treat this as a priority security fix within 1–2 weeks, not a standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects high impact (confidentiality, integrity, and availability all rated as high) and network-based attack vector, but requires user interaction and high attack complexity. However, CVSS underweights the significance of sandbox escape in Chrome's threat model; the actual security risk is closer to critical when contextualized within a multi-stage attack chain. The score appropriately represents the immediate vulnerability; operational risk is higher due to the severity of successful exploitation.

Frequently asked questions