CVE-2026-126873: Use after free in Extensions
Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.78
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-126885
- CVE-2026-126895
- CVE-2026-126879
- CVE-2026-126846
- CVE-2026-126911
- CVE-2026-126864
- CVE-2026-126889
- CVE-2026-126859
- CVE-2026-126886
- CVE-2026-126887
- CVE-2026-126870
- CVE-2026-126912
- CVE-2026-126919
- CVE-2026-126878
- CVE-2026-126909
- CVE-2026-126847
- CVE-2026-126853
- CVE-2026-126865
- CVE-2026-126916
- CVE-2026-126903
- CVE-2026-126910
- CVE-2026-126842
- CVE-2026-126898
- CVE-2026-126871
- CVE-2026-126875
- CVE-2026-126862
- CVE-2026-126900
- CVE-2026-126904
- CVE-2026-126907
- CVE-2026-126851
- CVE-2026-126845
- CVE-2026-126881
- CVE-2026-126867
- CVE-2026-126863
- CVE-2026-126896
- CVE-2026-126869
- CVE-2026-126858
- CVE-2026-126891
- CVE-2026-126874
- CVE-2026-126876
- CVE-2026-126918
- CVE-2026-126866
- CVE-2026-126844
- CVE-2026-126884
- CVE-2026-126894
- CVE-2026-126861
- CVE-2026-126917
- CVE-2026-126856
- CVE-2026-126905
- CVE-2026-126922
- CVE-2026-126914
- CVE-2026-126880
- CVE-2026-126872
- CVE-2026-126877
- CVE-2026-126888
- CVE-2026-126843
- CVE-2026-126854
- CVE-2026-126892
- CVE-2026-126897
- CVE-2026-126857
- CVE-2026-126883
- CVE-2026-126840
- CVE-2026-126848
- CVE-2026-126882
- CVE-2026-126906
- CVE-2026-126915
- CVE-2026-126893
- CVE-2026-126855
- CVE-2026-126908
- CVE-2026-126849
- CVE-2026-126901
- CVE-2026-126852
- CVE-2026-126850
- CVE-2026-126841
- CVE-2026-126902
- CVE-2026-126868
- CVE-2026-126921
- CVE-2026-126913
- CVE-2026-126890
- CVE-2026-126860
- CVE-2026-126920
- CVE-2026-126899
Frequently Asked Questions
Which systems are affected?
The issue affects Google Chrome on Windows versions earlier than 157.0.8103.78. The provided information does not identify exposure on other operating systems.
What must an attacker do to exploit this issue?
A remote attacker must use social engineering to get a target to interact with a crafted HTML page. Successful exploitation can result in arbitrary code execution outside Chrome's sandbox.
What is the remediation?
Update Google Chrome on Windows to version 157.0.8103.78 or later.