CVE-2026-126885: Use after free in ServiceWorker
Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.78
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-126895
- CVE-2026-126879
- CVE-2026-126846
- CVE-2026-126911
- CVE-2026-126864
- CVE-2026-126889
- CVE-2026-126859
- CVE-2026-126886
- CVE-2026-126887
- CVE-2026-126870
- CVE-2026-126912
- CVE-2026-126919
- CVE-2026-126878
- CVE-2026-126909
- CVE-2026-126847
- CVE-2026-126853
- CVE-2026-126865
- CVE-2026-126916
- CVE-2026-126903
- CVE-2026-126910
- CVE-2026-126842
- CVE-2026-126898
- CVE-2026-126871
- CVE-2026-126875
- CVE-2026-126862
- CVE-2026-126900
- CVE-2026-126904
- CVE-2026-126907
- CVE-2026-126851
- CVE-2026-126845
- CVE-2026-126881
- CVE-2026-126867
- CVE-2026-126863
- CVE-2026-126896
- CVE-2026-126869
- CVE-2026-126858
- CVE-2026-126891
- CVE-2026-126874
- CVE-2026-126876
- CVE-2026-126918
- CVE-2026-126866
- CVE-2026-126844
- CVE-2026-126884
- CVE-2026-126894
- CVE-2026-126861
- CVE-2026-126917
- CVE-2026-126856
- CVE-2026-126905
- CVE-2026-126873
- CVE-2026-126922
- CVE-2026-126914
- CVE-2026-126880
- CVE-2026-126872
- CVE-2026-126877
- CVE-2026-126888
- CVE-2026-126843
- CVE-2026-126854
- CVE-2026-126892
- CVE-2026-126897
- CVE-2026-126857
- CVE-2026-126883
- CVE-2026-126840
- CVE-2026-126848
- CVE-2026-126882
- CVE-2026-126906
- CVE-2026-126915
- CVE-2026-126893
- CVE-2026-126855
- CVE-2026-126908
- CVE-2026-126849
- CVE-2026-126901
- CVE-2026-126852
- CVE-2026-126850
- CVE-2026-126841
- CVE-2026-126902
- CVE-2026-126868
- CVE-2026-126921
- CVE-2026-126913
- CVE-2026-126890
- CVE-2026-126860
- CVE-2026-126920
- CVE-2026-126899
Frequently Asked Questions
Which Chrome versions are affected?
Google Chrome versions prior to 157.0.8103.78 are affected. Systems running that version or a later version are not identified as affected by the provided information.
What does an attacker need to exploit this issue?
A remote attacker needs to get a user to process a crafted HTML page in Chrome. The issue is associated with ServiceWorker functionality.
What is the potential impact of successful exploitation?
Successful exploitation can allow arbitrary code execution outside Chrome's sandbox.