CVE-2026-84349: High Use after free in Browser
Chromium: CVE-2026-84349 Use after free in Browser
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
— MITRE
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.62 - Upgrade
Upgrade
Google Chrome (Chromium)to a version that resolves this vulnerability.Fixed in 152.0.7977.75 - Compensating control
Because the vulnerability requires a compromised renderer process to escape the sandbox, ensure the browser sandboxing model remains enabled and restrict exposure to untrusted HTML content (e.g., do not open untrusted HTML in the browser) until patched.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need before this flaw can be used to escape the Chrome sandbox?
The attacker must first compromise the Chrome renderer process. After that prerequisite is met, a crafted HTML page can be used to execute arbitrary code outside the sandbox.
Which Chrome versions should be remediated?
Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or a later version.