CVE-2026-84349: Use After Free

Q: What does an attacker need before this flaw can be used to escape the Chrome sandbox?

The attacker must first compromise the Chrome renderer process. After that prerequisite is met, a crafted HTML page can be used to execute arbitrary code outside the sandbox.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or a later version.

Published Sep 1, 2026

Updated

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Google Chrome<152.0.7977.75

Event History

Sep 1, 2026

CVE Published

via MITRE·11:42 PM

Data Sourced

via MITRE·11:42 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need before this flaw can be used to escape the Chrome sandbox?

The attacker must first compromise the Chrome renderer process. After that prerequisite is met, a crafted HTML page can be used to execute arbitrary code outside the sandbox.

Which Chrome versions should be remediated?

Google Chrome versions prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or a later version.