# CVE-2026-126904: Google Chrome use-after-free in Compositing

Source: https://junglewise.ai/threats/cve-2026-126904-use-after-free-in-compositing-in-google-chrome-prior-to-157-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126904 · Severity: info · Published 2026-11-11

Google Chrome is a widely-used web browser. A use-after-free vulnerability in the Compositing component could allow an attacker who has already compromised the browser's renderer process to escape the sandbox and execute arbitrary code on the user's computer. This requires the attacker to first compromise the renderer (e.g., via a malicious website) but provides a path to full system compromise.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-126904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126904 being exploited in the wild.

**How severe is CVE-2026-126904?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Google Chrome prior to 157.0.8103.78.

**Is there a fix for CVE-2026-126904?** Yes: fixed in Chrome 157.0.8103.78. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126904 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126904?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Chrome 157.0.8103.78

## Technical details

A use-after-free vulnerability exists in Chrome's Compositing component, where memory is accessed after it has been freed. An attacker who has compromised the renderer process can trigger this flaw via a crafted HTML page to execute arbitrary code outside the sandbox, effectively breaking Chrome's security boundary. The fix is available in version 157.0.8103.78 and later.

## Affected products

- Google Chrome prior to 157.0.8103.78

## Timeline

- 2026-11-11: disclosed
- 2026-11-11: patched

## References

- [https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html)
- [https://issues.chromium.org/issues/574410140](https://issues.chromium.org/issues/574410140)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)