CVE-2026-9891
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A use-after-free vulnerability was found in Extensions in Google Chrome prior to 148.0.7778.216. A remote attacker who had compromised the renderer process could exploit a crafted Chrome Extension to potentially escape the sandbox.
Risk Assessment
This vulnerability allows an attacker with renderer access to bypass browser isolation entirely, potentially leading to full system compromise and data theft.
Recommendation
Immediately update Google Chrome to version 148.0.7778.216 or later. Restart the browser after the update.
Original NVD description (English source)
Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)