Brief Summary: Google Chrome CVE-2026-119260, a Use After Free in Frames Allowing Sandboxed Code Execution

Introduction

Google's Chrome Stable channel update of October 29, 2026 closed 21 security bugs. One of them, CVE-2026-119260, lets a crafted HTML page trigger a use after free in the Frames component and run arbitrary code inside the browser sandbox. Statcounter puts Chrome at 68.79% of worldwide browser usage in October 2026, so for most teams the practical work is making sure build 156.0.8078.79 is installed and actually activated on every endpoint.

This post is a brief summary built from public advisories, scanner documentation and distribution trackers. The Chromium bug entry is still access restricted, so there is no public root cause analysis, patch diff or exploit to examine, and we do not invent one. The sources do establish a High-severity memory safety bug with code execution confined to the sandbox, a clear version cutoff, and no confirmed exploitation in the reviewed public evidence.

Technical Information

Root cause: a memory lifetime failure in Frames

The Chrome CNA describes the bug as a use after free in Frames, classified as CWE 416. MITRE defines this weakness as reusing or referencing memory after it has been freed, and notes that the freed memory may be allocated again while the original pointer still references that location. When attacker-influenced data lands in that reallocated memory, a stale pointer can end up operating on attacker-controlled contents. That is how this class of bug escalates from a crash to code execution.

The public record for this specific CVE stops there. The sources do not identify the freed object, the ownership error, the HTML element or JavaScript API involved, the frame lifecycle sequence, any heap shaping technique, or the affected source function. Naming the component "Frames" is not enough to fill in those details.

The next paragraph is general context only. It comes from the patch summary we were given and has not been verified for this bug. In Frames code, a use after free usually means a reference to a frame or a frame-owned object outlives the frame itself, for example when a crafted page detaches or navigates an iframe while another code path is still using it. Chromium typically fixes this class of bug in one of three ways:

• making the lifetime relationship explicit
• rechecking that the frame is still attached after any call that can run script
• replacing a raw reference with a weak or GC-traced reference, so a dangling access is caught or never happens

Until the tracker entry is opened, we cannot confirm which of these, if any, Google used here.

What the CVSS vector establishes

NVD displays a CVSS 3.1 base score of 8.8 (High) attributed to CISA ADP, not to NVD's own assessment. Chromium separately rates the bug High. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which under the FIRST CVSS 3.1 specification means:

• AV:N: network-reachable attack context
• AC:L: low attack complexity under the scoring model
• PR:N: no prior privileges required
• UI:R: a user action is required, though the vector does not say which action
• S:U: impact stays within the same security authority
• C:H / I:H / A:H: high confidentiality, integrity and availability impact

The vector describes severity characteristics. It is not a probability of successful exploitation, and the High impact ratings should not be read as a claim that the whole operating system is compromised.

Attack flow, as documented

Based strictly on the CVE description and vector, the documented sequence is:

1. The attacker prepares a crafted HTML page and makes it reachable over the network. No privileges on the target are needed.
2. A user interaction is required for exploitation to succeed. The published vector does not specify the exact action.
3. Chrome processes the page, and the vulnerable Frames code references memory that has already been freed.
4. The attacker obtains arbitrary code execution inside the Chrome sandbox.

Chromium's sandbox design uses operating system security facilities to constrain what such code can do. The CVE explicitly limits the impact to execution inside that sandbox, and nothing in the sources demonstrates a sandbox escape. Containment still does not fix the bug. Code running in the sandbox is attacker code, so the update matters either way.

Why there is no code here

The only tracker reference, issue 573264074, returns "Access is denied to this issue" and NVD tags it "Permissions Required". This is standard Chromium practice. Security bugs and their fixing commits stay restricted until most users have the update, so the patch cannot be diffed while it is still useful to attackers. No bug description, reporter, fixing commit, Gerrit change, reproduction steps or code snippet is public, so this post contains none.

Exploitation status

The reviewed sources do not identify a threat actor, campaign, victim population or confirmed exploitation event.

• NotCVE shows "Exploited in Wild: No", SSVC "Exploitation None", and "CISA KEV: No". A secondary label is not proof that exploitation never occurred, and current KEV membership was not definitively established from the primary CISA catalog.
• Snyk shows an EPSS score of 0.24% at the 16th percentile. EPSS is a forecast updated daily. It does not measure observed activity.
• Tenable rates exploit ease as "No known exploits are available."

The defensible position is "exploitation not confirmed in the reviewed public evidence", which differs from both "actively exploited" and "not exploitable."

Patch Information

Status: Google has shipped the fix in a vendor release, but the source-level change is not public yet. The fix for CVE-2026-119260 is in the Stable and Extended Stable channel update released on Thursday, October 29, 2026 (release notes). One upstream summary dated the rollout to October 2. That date is wrong.

First fixed builds:

• Linux: 156.0.8078.79
• Windows and macOS: 156.0.8078.79 or 156.0.8078.80

The Chrome CNA record and NVD agree on the cutoff. NVD's CPE configuration marks cpe:2.3:a:google:chrome vulnerable up to (excluding) 156.0.8078.79, so .79 is the first build containing the fix. This CVE is one of 21 security fixes in that release, alongside other memory safety bugs in Skia, V8, Quota, Blink and FileSystem. One update addresses all of them.

HKCERT's October 30, 2026 bulletin lists the same platform versions and recommends installing the vendor fixes. HKCERT labels the multi-vulnerability update "Medium Risk", but that label describes the bulletin as a whole and should not be blended with the 8.8 score for this CVE.

Activating the update

Downloading an update and applying it are separate events. Per Google's Chrome Help:

1. Open Chrome and go to More > Help > About Google Chrome to check for the update.
2. Select Relaunch when offered. Pending updates normally apply only when Chrome closes and reopens. Choosing Not now postpones the fix until the next restart.
3. Keep automatic updates enabled, which Singapore's Cyber Security Agency also recommends in its Chrome guidance.

Ordinary windows and tabs reopen after the relaunch, but Incognito windows do not. Warn users about this before forcing restarts.

Downstream packaging

• Debian: fixed in chromium 156.0.8078.79 (package revision 1~deb13u1) for trixie security via Debian Security Advisory 6605, and in chromium 156.0.8078.79 revision 1 for sid. At the time of review, the Debian tracker still listed bookworm, including its 156.0.8078.79 security build, as vulnerable. Bookworm users should recheck the tracker rather than assume coverage. Separately, Snyk's Debian 13 entry reported no fixed version and warns that the upstream description does not directly describe Debian package versions. Treat that entry as neither proof of a fix nor proof that one is unavailable.
• Gentoo: bug 985241 (tracker) tracks the release. The www-client/google-chrome-156.0.8078.79 ebuild landed in commit 0c32af148e5b23e0fe0214639a47b9b554cffc98 on October 31, 2026. The same bug flags Microsoft Edge, Opera, Opera GX and Vivaldi as affected. Each needs its own vendor update that pulls in the 156.0.8078.79 Chromium base.

Verification rule: a browser is patched only if it reports 156.0.8078.79 or later (or .80 on Windows and macOS). For Chromium-based browsers, check the version of the underlying Chromium engine, not the vendor's own product version.

The reviewed advisories document no CVE-specific workaround or configuration change that substitutes for updating.

Detection Methods

All public detection coverage for CVE-2026-119260 works by checking installed versions. None of it looks for signs of an attack, so what it finds today is exposure rather than exploitation. In practice, treat any Chrome build below 156.0.8078.79 as exposed.

Tenable Nessus

Tenable maps four plugins to this CVE, all local checks:

• 373883: Google Chrome < 156.0.8078.79 Multiple Vulnerabilities (google_chrome_156_0_8078_79.nasl), Windows
• 373884: Google Chrome < 156.0.8078.79 Multiple Vulnerabilities (macosx_google_chrome_156_0_8078_79.nasl), MacOS X Local Security Checks
• 374256: Linux Distros Unpatched Vulnerability : CVE-2026-119260 (unpatched_CVE_2026_119260.nasl), Unix agent
• 374952: FreeBSD : chromium security fixes, FreeBSD Local Security Checks

How each plugin works affects how much weight to give its results:

• Windows and macOS (373883, 373884) check the KB item installed_sw/Google Chrome and compare Chrome's self-reported version against 156.0.8078.79. Tenable states that Nessus "has not tested for these issues but has instead relied only on the application's self-reported version number." Both plugins cover the whole October 2026 Chrome advisory, so a finding flags this CVE together with the other bugs fixed in the release (CVE-2026-76031, CVE-2026-119261, CVE-2026-119262, CVE-2026-119263 and others). Credentialed scans or Nessus Agents are required.
• Linux (374256) checks for the Debian chromium package (CPEs for Debian 12, 13 and 14) and links to the Debian tracker, relying on "the presence of the package as reported by the vendor." It requires the KB item global_settings/vendor_unpatched, so it only reports when your scan policy is set to show vendor-unpatched vulnerabilities. If Linux hosts come back clean unexpectedly, check that setting. The plugin currently lists no known solution, so expect it to keep firing until Debian ships a fixed package for the relevant release.
• FreeBSD (374952) is a standard VuXML-based check on the chromium port or package.

Rapid7

Rapid7's vulnerability database lists coverage for Google Chrome, with the check added on October 30, 2026. InsightVM and Nexpose users can search scan results for the CVE to find affected endpoints.

What does not exist yet

We found no public exploitation signatures: no Snort or Suricata rules, no YARA or Sigma content, no EDR analytics and no IoCs. There are three reasons. The Chromium bug is access restricted, so signature-relevant details are not public. Tenable reports no known exploits. And the attack arrives as a crafted HTML page rendered in the sandboxed renderer, typically over TLS and easy to obfuscate, which would make network signatures difficult even with details.

Practical guidance

• Run credentialed or agent-based checks with the plugins above across Windows, macOS, Linux and FreeBSD.
• Cross-check results against browser management or software inventory data and flag any Chrome or Chromium build below 156.0.8078.79.
• Remember that the Linux and FreeBSD plugins only see distribution chromium packages. Other Chromium-based browsers and Chrome copies bundled inside applications need separate tracking.
• Watch the vendor pages referenced here. If Google, Tenable or others later report exploitation in the wild or publish behavioral detections, those pages are the likeliest place for it to appear first.

Affected Systems and Versions

• Google Chrome desktop, all versions before 156.0.8078.79 (NVD CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, up to but excluding 156.0.8078.79).
• Linux: affected below 156.0.8078.79, fixed in 156.0.8078.79 or later.
• Windows and macOS: affected below 156.0.8078.79/.80, fixed in 156.0.8078.79 or 156.0.8078.80 or later. The .79/.80 notation reflects platform release guidance, not a different vulnerability mechanism per platform.
• Debian chromium packages: trixie is fixed in 156.0.8078.79 revision 1~deb13u1 and sid in 156.0.8078.79 revision 1. Bookworm was listed as vulnerable on the Debian tracker at review time, including its 156.0.8078.79 security build.
• Chromium-based browsers: Gentoo bug 985241 flags Microsoft Edge, Opera, Opera GX and Vivaldi as affected until each ships an update built on the 156.0.8078.79 Chromium base.

Market share figures are useful for gauging operational scope, but they are not a count of vulnerable installations.

Vendor Security History

Memory safety bugs remain the dominant class of serious Chrome vulnerabilities. Chromium's memory safety page reports that around 70% of serious security bugs are memory safety problems, so a new use after free is unsurprising despite sustained hardening investment.

MiraclePtr. Google's January 11, 2024 report describes enabling MiraclePtr for browser processes on Windows and Android in June 2022, extending it to processes other than renderers in September 2022, and enabling it on ChromeOS, macOS and Linux in June 2023. Google counts 168 qualifying use-after-free reports since launch and says MiraclePtr mitigated 57% of them in privileged processes. That analysis excluded bugs inside sandboxed renderer processes, so it says nothing about whether MiraclePtr would block CVE-2026-119260.

CVE-2022-3038 and the patch gap. Google also documented CVE-2022-3038, found through MiraclePtr crash reports and fixed in Chrome 105. Its Threat Analysis Group later found an exploit used against users of another Chromium-based browser that had not yet shipped the fix. Chromium's Chromium Chronicle #32 calls this interval, between a fix landing and reaching users, the patch gap. During it, attackers can study public fixes. This is historical context, not evidence of exploitation or attribution for the current CVE, but it bears directly on the Edge, Opera, Opera GX and Vivaldi exposure noted above.

Confirmed exploitation, for contrast. On November 18, 2025, Singapore's Cyber Security Agency reported that CVE-2025-13223, a V8 type confusion, was reportedly exploited in the wild. That kind of explicit language is absent from every source reviewed for CVE-2026-119260.

References

1. NVD: CVE-2026-119260
2. CVE Record: CVE-2026-119260
3. CVE Services API record (cveawg.mitre.org)
4. Chrome Releases: Stable Channel Update for Desktop
5. Chromium issue 573264074 (access restricted)
6. Debian Security Tracker entry
7. Gentoo Bugzilla entry
8. HKCERT: Google Chrome Multiple Vulnerabilities
9. Tenable plugins for CVE-2026-119260
10. Tenable Nessus plugin 373883
11. Tenable Nessus plugin 373884
12. Tenable Nessus plugin 374256
13. Rapid7 Vulnerability Database: CVE-2026-119260
14. Snyk: Use After Free in chromium (Debian 13)
15. NotCVE: CVE-2026-119260
16. CISA Known Exploited Vulnerabilities Catalog
17. CISA KEV JSON feed
18. Statcounter: Browser Market Share Worldwide
19. Google Chrome Help: Update Google Chrome
20. Google: How to Update Chrome
21. Chromium: Memory safety
22. Chromium sandbox design document
23. FIRST: CVSS v3.1 Specification
24. MITRE CWE 416: Use After Free
25. Google Online Security Blog: MiraclePtr on more platforms
26. The Chromium Chronicle #32: Mind the patch gap
27. Cyber Security Agency of Singapore: Active Exploitation of Zero Day Vulnerability in Google Chrome
28. Google: Stronger with every update