CVE-2026-5290
Published: 01 April 2026
Summary
CVE-2026-5290 is a critical-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the use-after-free vulnerability in Chrome's Compositing component to version 146.0.7680.178, directly preventing sandbox escape exploitation.
Memory protection techniques like ASLR and DEP directly mitigate use-after-free vulnerabilities by preventing unauthorized code execution in the compromised renderer process.
Process isolation enforces renderer sandbox boundaries, limiting the impact of use-after-free exploitation attempting to escape to other system processes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome renderer enables sandbox escape after initial renderer compromise, directly mapping to privilege escalation (T1068); delivered via crafted HTML on malicious site with user interaction, enabling drive-by compromise (T1189).
NVD Description
Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-5290 is a use-after-free vulnerability (CWE-416) in the Compositing component of Google Chrome prior to version 146.0.7680.178. Published on 2026-04-01, it has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is classified as High severity by Chromium security.
The vulnerability allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious site, but no privileges or special access beyond the initial renderer compromise.
Google addressed the issue in the stable channel update for desktop Chrome 146.0.7680.178, as announced at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/496205576.
Details
- CWE(s)