{"id":"CVE-2026-126899","kind":"vulnerability","aliases":["CVE-2026-126899"],"related":[],"title":"Google Chrome: use-after-free in Elements lets crafted page run code","description":"Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A use-after-free bug in the Elements component of Google Chrome before 157.0.8103.78 can be triggered by a crafted HTML page. A remote attacker who tricks a user into visiting that page can execute arbitrary code inside the browser sandbox.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","linux","macos","other","windows"],"not_affected_if":["chrome-updated"],"how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version` on Linux.\n- Confirm that the version is `157.0.8103.78` or later.","fix":"- Google Chrome: move to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:19+00:00","first_seen_at":"2026-11-11T23:29:39+00:00","triaged_at":"2026-11-11T23:31:50+00:00","updated_at":"2026-11-11T23:31:50+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-11T23:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.78` or later.","reach":"internet","title":"Google Chrome: use-after-free in Elements lets crafted page run code","impact":"high","summary":"A use-after-free bug in the Elements component of Google Chrome before 157.0.8103.78 can be triggered by a crafted HTML page. A remote attacker who tricks a user into visiting that page can execute arbitrary code inside the browser sandbox.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","browsers","windows","macos","linux"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox after a crafted page visit.","analyst_note":"","how_to_check":"- Check the installed Chrome version in the browser's About page or with `google-chrome --version` on Linux.\n- Confirm that the version is `157.0.8103.78` or later.","plain_action":"Update Google Chrome to version 157.0.8103.78 or later, and restart the browser.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Anyone running Google Chrome older than 157.0.8103.78 who visits untrusted web pages. Exposure is through normal browsing, so any installation below the fixed version is affected, and systems on managed fleets should confirm their update policy has applied the patch.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4533,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126899':16A,19A '-2026':15A,18A '157.0.8103.78':40B,78C 'allow':79C 'arbitrari':62B,88C 'attack':51B,82C 'browser':20B,66B 'bug':31B 'chrome':2A,21B,38B,75C 'chromium':98C 'code':13A,63B,89C 'compon':35B 'craft':10A,46B,95C 'cve':14A,17A 'element':8A,34B,72C 'engin':85C 'execut':61B,87C 'free':6A,30B,70C 'googl':1A,37B,74C 'high':101C 'html':47B,96C 'insid':64B,90C 'let':9A 'leverag':83C 'linux':22B 'maco':23B 'page':11A,48B,59B,97C 'prior':76C 'remot':50B,81C 'run':12A 'sandbox':67B,92C 'secur':99C 'sever':100C 'social':84C 'trick':53B 'trigger':43B 'use':4A,28B,68C 'use-after-fre':3A,27B 'user':55B 'via':93C 'visit':57B 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome older than 157.0.8103.78 who visits untrusted web pages. Exposure is through normal browsing, so any installation below the fixed version is affected, and systems on managed fleets should confirm their update policy has applied the patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later, and restart the browser.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","high","linux","macos","other","windows"],"campaign_type":null,"search_a":"'-126899':16A,19A '-2026':15A,18A 'chrome':2A 'code':13A 'craft':10A 'cve':14A,17A 'element':8A 'free':6A 'googl':1A 'let':9A 'page':11A 'run':12A 'use':4A 'use-after-fre':3A","search_b":"'157.0.8103.78':40B 'arbitrari':62B 'attack':51B 'browser':20B,66B 'bug':31B 'chrome':21B,38B 'code':63B 'compon':35B 'craft':46B 'element':34B 'execut':61B 'free':30B 'googl':37B 'html':47B 'insid':64B 'linux':22B 'maco':23B 'page':48B,59B 'remot':50B 'sandbox':67B 'trick':53B 'trigger':43B 'use':28B 'use-after-fre':27B 'user':55B 'visit':57B 'window':25B","search_c":"'157.0.8103.78':78C 'allow':79C 'arbitrari':88C 'attack':82C 'chrome':75C 'chromium':98C 'code':89C 'craft':95C 'element':72C 'engin':85C 'execut':87C 'free':70C 'googl':74C 'high':101C 'html':96C 'insid':90C 'leverag':83C 'page':97C 'prior':76C 'remot':81C 'sandbox':92C 'secur':99C 'sever':100C 'social':84C 'use':68C 'via':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126899","severity":null,"published_at":"2026-11-11T23:17:19+00:00","modified_at":"2026-11-11T23:17:19+00:00","first_seen_at":"2026-11-11T23:29:39+00:00","fetched_at":"2026-11-11T23:29:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}