Executive brief
Google Chrome is a widely-used web browser that runs untrusted web content in sandboxed processes. A vulnerability in the WebUI component could allow an attacker who has already compromised Chrome's renderer process to bypass the sandbox and execute arbitrary code with full browser privileges. This could enable theft of passwords, cookies, and other sensitive user data, or installation of malware.
Technical details
The vulnerability is a privilege escalation in WebUI that affects Chrome versions prior to 153.0.8010.36. An attacker who has compromised the renderer process (the sandboxed component that executes untrusted web content) can exploit this flaw via a crafted HTML page to execute arbitrary code outside the sandbox with elevated privileges. This breaks the sandbox security boundary that normally isolates web content from the browser itself and the operating system. The vulnerability requires prior renderer compromise but provides a critical post-exploitation path to full system access. Chrome 153.0.8010.36 and later contain the fix.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched