CVE-2026-7917 is a use-after-free vulnerability affecting the Fullscreen functionality in Google Chrome on Windows platforms before version 148.0.7778.96. The vulnerability allows a remote attacker, who has already compromised the renderer process, to potentially perform a sandbox escape by leveraging a crafted HTML page. This type of vulnerability can undermine the browser's security model by allowing code execution outside the intended sandbox environment. The vulnerability is marked as high severity by the Chromium security team. The vendor advisory linked is a general stable channel update announcement without explicit patch confirmation for this CVE. No CVSS score or remediation level is provided in the data.

If successfully exploited, this vulnerability could allow an attacker with control over the renderer process to escape the sandbox, potentially leading to execution of arbitrary code with higher privileges on the host system. This elevates the risk beyond typical renderer process compromises, increasing the potential damage of an attack. However, there are no known exploits reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 148.0.7778.96 or later once confirmed patched. Until then, no specific mitigations are provided by the vendor advisory.