Executive brief
A security vulnerability has been identified in the password management component of Google Chrome on Windows. This flaw could allow a malicious website to break out of the browser's security sandbox, which is designed to keep web content isolated from the rest of the computer. If exploited, an attacker could potentially gain unauthorized access to the underlying operating system and sensitive user data.
Technical details
A use-after-free (UAF) vulnerability exists in the Passwords component of Google Chrome for Windows. The flaw is triggered when the browser incorrectly manages memory during password-related operations. An attacker who has already compromised the renderer process (for example, via a separate memory corruption bug) can exploit this UAF to perform a sandbox escape. This is achieved by enticing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to execute arbitrary code outside of the restricted browser sandbox with the privileges of the logged-in user. The issue is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Fixed in Stable Channel Update 148.0.7778.216/217
- 2026-05-28: disclosed: CVE-2026-10000 published by NVD