CVE-2026-5289

CriticalCVSS 9.6/10Last modified Oct 26, 2026

Description

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 146.0.7680.178, < 146.0.7680.178

References

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.htmlVendor Advisory
https://issues.chromium.org/issues/495931147Issue Tracking, Permissions Required

Timeline

Published: Apr 1, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-528907.1Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through CVE-2026-528919.9Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths la CVE-2026-528926.5Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentica CVE-2026-528939.2Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC log CVE-2026-528996.9Deserialization of untrusted data for some BigDL software before version 2.5.0b1 within Ring 3: User Applications may allow an escalation of CVE-2026-52909.6Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to CVE-2026-529024.7A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing CVE-2026-529038.8A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fal CVE-2026-529045.5In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When ape CVE-2026-529055.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow non-power of two min_region_sz on damon_start()CVE-2026-529067.7In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit CVE-2026-529077.8In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons f