CVE-2026-9902: Chrome Accessibility Sandbox Escape (Use-After-Free)

Technical summary

CVE-2026-9902 is a use-after-free vulnerability (CWE-416) in the Accessibility subsystem of Google Chrome. The flaw exists in versions prior to 148.0.7778.216 and permits a remote attacker with a compromised renderer process to achieve sandbox escape through a specially crafted HTML page. The Chromium security team has classified this as High severity. The vulnerability requires user interaction (visiting a malicious webpage) and assumes the renderer process is already compromised, making it part of a multi-stage attack chain. Successful exploitation could result in arbitrary code execution at the system level, bypassing Chrome's process isolation model.

Business impact

Organizations relying on Chrome as their primary browser face elevated risk if users visit untrusted websites or if renderer-process vulnerabilities are actively exploited in the wild. A sandbox escape could allow attackers to access sensitive data, install malware, or pivot to other systems on the corporate network. The vulnerability is particularly concerning in environments where Chrome is used to access high-value applications or where renderer-process exploits are already circulating. Companies should prioritize patching to maintain the integrity of their browser-based security boundaries.

Affected systems

Google Chrome versions prior to 148.0.7778.216 are vulnerable. All platforms running affected Chrome versions—including Windows, macOS, and Linux—are at risk. Users should verify their installed Chrome version against the fixed release. Chrome's auto-update mechanism typically deploys patches within hours or days, but organizations with update controls should manually verify deployment.

Exploitability

Exploitation requires two conditions: first, compromise of the Chrome renderer process (via a separate renderer-process vulnerability or attack), and second, user interaction to visit a crafted HTML page. While the barrier to entry is moderate due to the renderer-process prerequisite, the payload is within reach of sophisticated threat actors. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited or no confirmed in-the-wild exploitation as of the publication date, though organizations should monitor for changes to this status.

Remediation

Update Google Chrome to version 148.0.7778.216 or later immediately. Chrome's built-in update mechanism should deliver this patch automatically; users can accelerate this by restarting the browser or manually checking for updates via the menu. Organizations with centralized Chrome management should deploy the patched version through their endpoint management tools. No workarounds exist for the underlying code defect.

Patch guidance

Verify that Chrome has updated to 148.0.7778.216 or a later stable release. Check the version via Chrome menu > About Google Chrome (which will also trigger any pending update). For managed environments, confirm that the patch has been distributed to all endpoints. Monitor Chrome's release notes and security updates page for any subsequent patches addressing related accessibility features. If using Chrome Enterprise, leverage your MDM/EMM solution to enforce the minimum version requirement across your fleet.

Detection guidance

Monitor for Chrome processes running versions prior to 148.0.7778.216 using endpoint detection and response (EDR) tools or vulnerability management platforms. Network-based detection of in-the-wild exploitation is challenging without renderer-process vulnerability signatures; focus on endpoint-level version inventory. If a renderer-process exploit is active in your environment, treat any subsequent unusual process behavior, privilege elevation, or system modification on machines that visited untrusted sites as a potential sandbox-escape attempt. Log review should focus on elevated privilege creation and unusual child-process spawning from Chrome or related system processes.

Why prioritize this

This vulnerability merits immediate attention because successful exploitation grants system-level code execution by breaking Chrome's sandbox isolation. While the renderer-process requirement raises the bar for exploitation, the sandbox-escape component is the critical differentiator—it transforms a browser compromise into a system compromise. The CVSS score of 8.3 (HIGH) reflects the severity of the impact. Organizations should treat patching as a critical priority, particularly if renderer-process exploits are known to be active or if users frequently visit untrusted content.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects a High-severity vulnerability with network-based attack vector, high attack complexity (due to the renderer-process prerequisite), no privilege requirement, user interaction, and changed scope—all leading to high impact on confidentiality, integrity, and availability. The score appropriately captures the severity of a sandbox escape, which can fully compromise a system despite the prerequisite nature of renderer-process compromise.

Frequently asked questions