CVE-2026-10000 is a use-after-free vulnerability in the Passwords feature of Google Chrome on Windows platforms before version 148.0.7778.216. Exploitation requires that an attacker already control the renderer process, enabling them to potentially perform a sandbox escape via crafted HTML content. The vulnerability has a high impact on confidentiality, integrity, and availability, as indicated by the CVSS vector. The vendor advisory is available but does not explicitly state the patch or remediation status.

Successful exploitation could allow an attacker with renderer process access to escape the Chrome sandbox, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until confirmation of patch availability, users should exercise caution with untrusted content and consider updating to the latest Chrome version once updates are confirmed.