Google Patches Chrome Sandbox Escape Vulnerability with 150.0.7871.186 Update

Google on July 23 shipped Chrome 150.0.7871.186 for Windows and macOS, closing a high-severity use-after-free vulnerability in the browser's Input component that could allow an attacker to break out of Chrome's renderer sandbox. The fix, tracked as CVE-2026-16804, requires that an attacker first compromise the renderer process, but underscores the importance of keeping browsers rigorously updated.

Four High-Severity Fixes in One Release

Chrome 150.0.7871.186 doesn't just patch one bug — it resolves four distinct high-severity vulnerabilities, each carrying the potential to compromise user security. In addition to the sandbox escape issue, Google fixed an out-of-bounds write in Codecs (CVE-2026-16807) and two more use-after-free flaws in WebMCP (CVE-2026-16806) and Blink (CVE-2026-16805). The update bumps the stable channel to 150.0.7871.186 for Linux and .187 on Windows and macOS.

Here are the details at a glance:

For Windows users, the operational version number to look for is 150.0.7871.187. Google notes that the update rolls out gradually, so you might not see it immediately. To check manually, hit the three-dot menu, go to Help > About Google Chrome, and let the browser fetch the latest version.

What CVE-2026-16804 Means for Your PC

CVE-2026-16804 is a memory-safety flaw in the Input subsystem — a crucial part of Chrome that handles every keystroke, touch, and pointer event. A use-after-free bug occurs when the browser frees a chunk of memory but later tries to access it as if it were still valid. If an attacker can manipulate what occupies that memory space after it's freed, they might redirect program flow or execute malicious code.

In this case, Google states that a remote attacker who has already compromised the renderer process could craft an HTML page to trigger the bug and “potentially perform a sandbox escape.” That means a single phishing link or malicious ad wouldn't directly give an attacker control of your PC. But if they've already found another way to break into Chrome's renderer — through a separate vulnerability — this bug could let them jump from the renderer into more privileged parts of the browser, and possibly the operating system.

The Sandbox Escape Chain

Chrome's architecture is designed to contain web content inside locked-down renderer processes. Even if a tab misbehaves, the sandbox should prevent it from touching your files, network, or other applications. A sandbox escape breaks that wall. The typical attack pattern looks like this:

1. A user visits a malicious website or opens a booby-trapped document in Chrome.
2. An initial exploit compromises the renderer process — perhaps via a JavaScript engine bug.
3. The attacker then uses CVE-2026-16804 to target the Input component from within the renderer, aiming to escalate privileges.
4. If successful, the attacker escapes the sandbox and can attempt further actions, such as installing malware or stealing credentials.

The CVSS v3.1 score of 8.3 (High) assigned by CISA reflects this chain potential: network attack vector, high complexity, no privileges required, user interaction needed, and possible scope change leading to high impact on confidentiality, integrity, and availability.

Who Should Worry — and Who Should Act Now

Everyday home users should treat this update as urgent but routine. Because the vulnerability requires an already-compromised renderer, the immediate risk of being hit by a single-click attack is low. However, attackers often package multiple exploits into a single campaign, so unpatched browsers are always a sitting duck. Open chrome://settings/help, click “Relaunch,” and you're protected.

IT administrators face a different picture. Chrome is the gateway to corporate apps, cloud consoles, and sensitive data. A sandbox escape on an employee's machine could expose an entire internal network. The four bundled high-severity fixes make this a must-deploy update. Check your endpoint management console for devices still running Chrome 149 or earlier. Enforce a restart deadline — a downloaded update that never relaunches doesn't protect anyone.

Developers and power users running Chromium-based browsers like Edge, Brave, or Opera should note that while this specific CVE is tagged for Google Chrome, the underlying codebase often shares components. Microsoft and other vendors will likely issue their own patches soon, but until then, switching temporarily to an updated Chrome is a sensible precaution if you regularly visit untrusted sites.

How We Got Here: The Anatomy of a Chrome Emergency Fix

Google's Chrome security team found CVE-2026-16804 internally? The advisory doesn't credit an external researcher, which suggests it was discovered through Google's own fuzzing or code audit. The bug was reported on a restricted Chromium issue tracker (524721670), with details kept secret to prevent attackers from weaponizing it before users update.

Use-after-free vulnerabilities are depressingly common in complex C++ browsers. Despite years of investment in memory-safe alternatives like Rust and sanitizers like AddressSanitizer and MemorySanitizer, Chromium still ships millions of lines of C++ code where manual memory management mistakes happen. The Input component is particularly tricky: it processes a firehose of asynchronous events from the OS, each potentially triggering object creation and deletion.

This isn't the first sandbox escape bug to hit Chrome, and it won't be the last. In 2024, a similar use-after-free in the Skia graphics library (CVE-2024-0519) allowed out-of-bounds write and potential sandbox escape. The pattern repeats because browser sandboxes are a high-value target — they're the last line of defense before the OS.

What to Do Now: A Practical Checklist

For Individual Users:

• Update Chrome immediately. Go to chrome://settings/help and wait for the version to show 150.0.7871.186 or later.
• Relaunch the browser. Chrome often downloads updates in the background but won't apply them until you restart. Look for the green arrow in the corner or a “Relaunch” button in the About screen.
• Double-check version. After relaunch, revisit the About page to confirm the patch took.
• Restart Windows. While not strictly necessary, a full reboot ensures no old Chrome processes linger in the background (some background apps keep running).
• Review extensions. Remove any you don't recognize. Extensions can weaken the sandbox if they have broad permissions.

For IT and Security Teams:

• Deploy the update via your management platform. If you use group policies, WSUS, or a third‑party updater, push Chrome 150.0.7871.186 now.
• Force browser restarts. Use the RelaunchNotificationPeriod policy to warn users, then force a restart after a deadline.
• Audit your fleet. Scan for Chrome versions and flag devices that are behind. A one‑day lag is acceptable; a week is not.
• Check update policies. Disable any policy that indefinitely blocks Chrome updates — those can be overridden for security reasons.
• Enable Enhanced Safe Browsing. It won't stop a sandbox escape, but it can block the malicious pages that deliver the initial renderer exploit.
• Watch for exploitation. Keep an eye on EDR logs for unusual Chrome behavior, like spawning cmd.exe or PowerShell, or writing to unexpected directories.

What's Next for Chrome Security?

Google hasn't said whether CVE-2026-16804 is being exploited in the wild. The SSVC decision from CISA lists “Exploitation: none,” meaning as of July 24, 2026, there were no known active attacks. But that can change overnight.

The broader lesson for Windows users is that browser updates are not optional. Each Chrome release fixes dozens of bugs, and high‑severity issues like this one can blindside anyone who presses “remind me later” one too many times. Enterprises should treat browser patch lag with the same urgency as unpatched OS flaws.

Chrome 151 is already in the dev channel, and the cat‑and‑mouse game with vulnerability researchers and attackers will continue. In the meantime, version 150.0.7871.186 should be on every Windows PC you own or manage.