CVE-2026-5290: Google Chrome Use After Free Vulnerability

CVE-2026-5290 Overview

CVE-2026-5290 is a use-after-free vulnerability [CWE-416] in the Compositing component of Google Chrome versions prior to 146.0.7680.178. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Sandbox escape elevates a renderer-bound foothold into broader access on the host operating system. The flaw affects Chrome installations across Windows, macOS, and Linux desktops. Google's Chromium security team assigned the issue a High severity rating, and the public CVSS score reflects critical impact across confidentiality, integrity, and availability.

Critical Impact
Successful exploitation chains a compromised renderer with this Compositing flaw to break out of the Chrome sandbox, granting attacker code execution outside the browser's confinement boundary.

Affected Products

Google Chrome versions prior to 146.0.7680.178
Chrome desktop on Microsoft Windows
Chrome desktop on Apple macOS and Linux

Discovery Timeline

2026-04-01 - CVE-2026-5290 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5290

Vulnerability Analysis

The vulnerability resides in Chrome's Compositing subsystem, which manages the layered rendering of web content into the final on-screen image. A use-after-free condition occurs when the component retains a dangling reference to a memory object that has already been released. An attacker can reclaim that freed memory with attacker-controlled data and force the compositor to dereference it.

Exploitation requires a prior renderer compromise, typically via a separate memory corruption bug in the JavaScript engine or DOM. Once the renderer is under attacker control, the Compositing flaw becomes the second link in an exploit chain. The compositor runs with broader privileges than the sandboxed renderer, so corrupting its state can yield a sandbox escape. User interaction in the form of visiting a crafted HTML page is required.

Root Cause

The root cause is improper object lifetime management within the Compositing code path. A reference to a compositor object outlives the object's deallocation, leaving an exploitable dangling pointer that the renderer can reach across the inter-process boundary.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious page, lures the victim to load it, and runs renderer-side exploit code to first take over the sandboxed process. The code then triggers the Compositing use-after-free to corrupt memory in a higher-privilege Chrome process and escape the sandbox. Further details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-5290

Indicators of Compromise

Chrome renderer or GPU process crashes referencing compositor frame or layer objects in stack traces.
Unexpected child processes spawned from chrome.exe or the Chrome helper process following a browsing session.
Outbound connections to unfamiliar domains immediately after a Chrome tab loads attacker-controlled HTML.

Detection Strategies

Inventory Chrome versions across the fleet and flag any instance below 146.0.7680.178 for remediation.
Hunt for renderer-to-host process lineage anomalies, such as Chrome processes launching shells, scripting hosts, or LOLBins.
Correlate browser crash telemetry with proxy logs to identify users who visited unknown sites prior to a crash.

Monitoring Recommendations

Forward Chrome crash dumps and Windows Error Reporting events to a central log store for review.
Monitor EDR telemetry for memory protection violations and unusual handle activity originating from browser processes.
Track DNS and TLS SNI logs for new or low-reputation domains accessed by browser sessions immediately before suspicious activity.

How to Mitigate CVE-2026-5290

Immediate Actions Required

Update Google Chrome to version 146.0.7680.178 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update so that the patched binaries are loaded into memory.
Validate deployment with software inventory tools to confirm no legacy versions remain in use.

Patch Information

Google shipped the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update. Administrators using Chrome Browser Enterprise should push the update via group policy or their management platform of choice. Managed Chromebooks receive the corresponding ChromeOS update through standard auto-update channels.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patching is complete.
Enable Chrome's Site Isolation and Enhanced Safe Browsing to raise the cost of renderer compromise.
Apply application control or EDR policies that block child process creation from Chrome processes.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read the bundled version string
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString