{"id":"CVE-2026-125343","kind":"vulnerability","aliases":["CVE-2026-125343"],"related":[],"title":"Chrome: compositing buffer overflow lets a compromised renderer escape the sandbox","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A buffer overflow in Chrome's Compositing component lets an attacker who already controls the renderer process run arbitrary code outside the browser sandbox. The attacker delivers the trigger through a crafted HTML page.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","desktop","runtime"],"not_affected_if":["chrome-updated","no-untrusted-browsing"],"how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version`\n- Compare it against the fixed version `157.0.8103.50`\n- On managed fleets, query the Chrome version reported by the device management console","fix":"- Google Chrome: move to `157.0.8103.50` or later","status":"open","published_at":"2026-11-10T18:17:34+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","triaged_at":"2026-11-10T18:26:45+00:00","updated_at":"2026-11-10T18:26:45+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T18:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.50` or later","reach":"internet","title":"Chrome: compositing buffer overflow lets a compromised renderer escape the sandbox","impact":"high","summary":"A buffer overflow in Chrome's Compositing component lets an attacker who already controls the renderer process run arbitrary code outside the browser sandbox. The attacker delivers the trigger through a crafted HTML page.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browsers","desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code outside the Chrome sandbox on the device","analyst_note":"","how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version`\n- Compare it against the fixed version `157.0.8103.50`\n- On managed fleets, query the Chrome version reported by the device management console","plain_action":"Update Google Chrome to version 157.0.8103.50 or later: open the menu, choose Help, then About Google Chrome.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-updated","no-untrusted-browsing"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.50 who browses untrusted web pages is exposed. Chromium-based browsers that pull the same Compositing code may also be affected, depending on their own release timing. Systems where Chrome is not used to browse external sites are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4543,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-125343':14A,17A '-2026':13A,16A '157.0.8103.50':65C 'allow':66C 'alreadi':34B 'arbitrari':40B,78C 'attack':32B,47B,69C 'browser':18B,44B 'buffer':3A,23B,56C 'chrome':1A,19B,26B,62C 'chromium':88C 'code':41B,79C 'compon':29B 'composit':2A,28B,59C 'compromis':7A,72C 'control':35B 'craft':53B,85C 'cve':12A,15A 'deliv':48B 'desktop':20B 'escap':9A 'execut':77C 'googl':61C 'high':91C 'html':54B,86C 'let':5A,30B 'outsid':42B,80C 'overflow':4A,24B,57C 'page':55B,87C 'prior':63C 'process':38B,75C 'remot':68C 'render':8A,37B,74C 'run':39B 'runtim':21B 'sandbox':11A,45B,82C 'secur':89C 'sever':90C 'trigger':50B 'via':83C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.50 who browses untrusted web pages is exposed. Chromium-based browsers that pull the same Compositing code may also be affected, depending on their own release timing. Systems where Chrome is not used to browse external sites are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.50 or later: open the menu, choose Help, then About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","desktop","high","runtime"],"campaign_type":null,"search_a":"'-125343':14A,17A '-2026':13A,16A 'buffer':3A 'chrome':1A 'composit':2A 'compromis':7A 'cve':12A,15A 'escap':9A 'let':5A 'overflow':4A 'render':8A 'sandbox':11A","search_b":"'alreadi':34B 'arbitrari':40B 'attack':32B,47B 'browser':18B,44B 'buffer':23B 'chrome':19B,26B 'code':41B 'compon':29B 'composit':28B 'control':35B 'craft':53B 'deliv':48B 'desktop':20B 'html':54B 'let':30B 'outsid':42B 'overflow':24B 'page':55B 'process':38B 'render':37B 'run':39B 'runtim':21B 'sandbox':45B 'trigger':50B","search_c":"'157.0.8103.50':65C 'allow':66C 'arbitrari':78C 'attack':69C 'buffer':56C 'chrome':62C 'chromium':88C 'code':79C 'composit':59C 'compromis':72C 'craft':85C 'execut':77C 'googl':61C 'high':91C 'html':86C 'outsid':80C 'overflow':57C 'page':87C 'prior':63C 'process':75C 'remot':68C 'render':74C 'sandbox':82C 'secur':89C 'sever':90C 'via':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","severity":null,"published_at":"2026-11-10T18:17:34+00:00","modified_at":"2026-11-10T18:17:34+00:00","first_seen_at":"2026-11-10T18:22:56+00:00","fetched_at":"2026-11-10T18:22:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}