CVE-2026-76023: Improper resource control in Google Chrome

This vulnerability in Google Chrome's Linux Toolkit Theming prior to version 151.0.7922.173 allows a remote attacker with control over the renderer process to execute arbitrary code outside the sandbox environment. The flaw is due to improper resource control, which can be exploited via a specially crafted HTML page. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables remote code execution outside the sandbox, potentially compromising the host system's security. This can lead to full system compromise, data theft, or disruption of service. The vulnerability requires the attacker to have already compromised the renderer process and to trick the user into interacting with a crafted HTML page.

A stable channel update for Google Chrome has been released to address this vulnerability. Users and administrators should update Chrome to version 151.0.7922.173 or later to mitigate this issue. No additional mitigation steps are indicated by the vendor advisory.