CVE-2026-9966: Chrome XML Integer Overflow Sandbox Escape (Windows) – Patch Now

Technical summary

CVE-2026-9966 is an integer overflow vulnerability in Chrome's XML processing on Windows platforms (versions prior to 148.0.7778.216). The flaw exists in the renderer process and can be triggered by a crafted HTML page. Integer overflows occur when numeric calculations exceed the maximum value a variable can hold, causing wraparound and unpredictable behavior. In this case, the overflow enables an attacker with renderer-process compromise to break out of the Chrome sandbox isolation mechanism, potentially gaining code execution at the Windows system level. The Chromium project assigned this a High security severity rating.

Business impact

A successful exploitation chain—requiring initial renderer compromise followed by sandbox escape—could result in complete compromise of an affected Windows system, including data theft, malware installation, credential harvesting, and lateral movement to other network resources. For organizations where employees use Chrome as their primary browser, this represents a material risk if combined with other attack vectors (such as browser exploits or social engineering) that achieve the initial renderer compromise. The impact is particularly acute in environments handling sensitive data or connected to critical infrastructure.

Affected systems

Google Chrome on Windows systems running versions prior to 148.0.7778.216 are vulnerable. The vulnerability does not affect Chrome on other operating systems (macOS, Linux, Android, iOS) based on the advisory scope. Windows users on version 148.0.7778.216 and later are protected. Note that this vulnerability is specific to Google Chrome; other Chromium-based browsers (Edge, Brave, Opera) may or may not be affected depending on their patch status and whether they backport fixes.

Exploitability

While the vulnerability has a high CVSS score (8.3), real-world exploitability is constrained by several factors. An attacker must first compromise the Chrome renderer process through a separate vulnerability or attack method. Second, the victim must visit a crafted HTML page while the renderer is compromised. Third, successful exploitation depends on the specific memory layout and Chrome version at runtime. The vulnerability is not currently known to be exploited in the wild (KEV status: not listed), and no public exploit code is documented. However, given the high severity rating and the potential for severe impact, it should be treated as a credible threat requiring prompt patching.

Remediation

Update Google Chrome to version 148.0.7778.216 or later on all Windows systems. Chrome's automatic update mechanism should deliver this patch; verify the update has completed by checking Settings > About Chrome, which will show the installed version and trigger an immediate check for updates if you are behind. For managed environments, use your device management platform (Intune, Google Workspace admin console, or third-party MDM) to enforce deployment of the patched version. No workarounds exist for this vulnerability, making patching the only mitigation.

Patch guidance

Verify your Chrome version by navigating to chrome://settings/help. If you are on a version prior to 148.0.7778.216, manually trigger an update check or restart Chrome to force the update. In enterprise environments, confirm that your auto-update policies are enabled and that Windows systems have network access to Google's update servers. Test the patched version in a non-critical environment if you maintain a staged rollout process. If you use Chromium-based alternatives (Chromium builds, Edge, Brave, Opera), check each vendor's advisory separately to confirm patch status and version requirements, as backporting timelines vary.

Detection guidance

Monitor Chrome version compliance across your environment using your endpoint detection and response (EDR) solution or mobile device management (MDM) platform to identify systems still running vulnerable versions. Set detection rules to flag Chrome versions prior to 148.0.7778.216 on Windows systems. If you suspect exploitation has occurred, look for anomalous child process creation from the Chrome process (chrome.exe), unexpected system calls from Chrome, or use of tools like ProcDump to extract memory from Chrome processes—these may indicate sandbox escape attempts. Network signatures that detect XML parsing errors or malformed XML payloads in HTTP traffic are less practical here, given the client-side nature of the vulnerability.

Why prioritize this

This vulnerability merits immediate patching priority due to its high severity (CVSS 8.3), potential for complete system compromise via sandbox escape, and the broad user base of Chrome on Windows. Although exploitation requires pre-existing renderer compromise, defenders cannot assume their environments are free from initial infection vectors. The absence of a KEV listing (no known active exploitation) provides a narrow window to patch before this becomes a mass-exploitation target. Prioritize systems used by high-value targets (executives, developers, system administrators, financial teams) first, then expand to general user populations.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the combination of network-accessible attack surface (AV:N), high complexity required for successful exploitation (AC:H), no required privileges (PR:N), requirement for user interaction (UI:R), scope change (S:C—impact extends beyond the Chrome process to the system), and high confidentiality, integrity, and availability impact (C:H, I:H, A:H). The complexity factor is elevated because the attacker must first compromise the renderer process and then successfully exploit the integer overflow to escape the sandbox; these are not trivial steps. However, once both conditions are met, the impact is catastrophic, justifying the HIGH severity.

Frequently asked questions