CVE-2026-84350: Use after free in TabStrip
Chromium: CVE-2026-84350 Use after free in TabStrip
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Low)
— MITRE
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.7977.75 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.62 - Upgrade
Upgrade
Chromium (Google Chrome/Edge Chromium-based)to a version that resolves this vulnerability.Fixed in 152.0.7977.75Patch CVE-2026-84350
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-84353
- CVE-2026-84352
- CVE-2026-84354
- CVE-2026-84359
- CVE-2026-84357
- CVE-2026-84324
- CVE-2026-84349
- CVE-2026-84326
- CVE-2026-84333
- CVE-2026-84351
- CVE-2026-84325
- CVE-2026-84328
- CVE-2026-84347
- CVE-2026-84323
- CVE-2026-84355
- CVE-2026-84358
- CVE-2026-84332
- CVE-2026-84330
- CVE-2026-84334
- CVE-2026-84348
- CVE-2026-84335
- CVE-2026-84327
- CVE-2026-84329
- CVE-2026-84356
- CVE-2026-84331
Frequently Asked Questions
Which Chrome releases need to be remediated?
Google Chrome releases prior to 152.0.7977.75 are affected. Update Chrome to 152.0.7977.75 or later.
What would an attacker need to exploit this issue?
The attacker must remotely induce user interaction through social engineering. Successful exploitation can result in arbitrary code execution outside the Chrome sandbox.
Are systems affected without user involvement?
The available information describes exploitation through UI interaction and social engineering, so user interaction is part of the stated attack scenario.