CVE-2026-84349: Use after free in Google Chrome

This vulnerability involves a use-after-free condition in the Browser component of Google Chrome versions before 152.0.7977.75. An attacker who has already compromised the renderer process can exploit this flaw by delivering a specially crafted HTML page, enabling them to execute arbitrary code outside the sandbox environment. This elevates the attacker's capabilities beyond the renderer sandbox, potentially leading to full system compromise. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution outside the sandbox, which can lead to full system compromise. The attacker must have already compromised the renderer process and trick the user into interacting with a crafted HTML page. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Google has released an update in Chrome version 152.0.7977.75 that addresses this vulnerability. Users should update to this version or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying the official patch. Check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for the latest update information.