CVE-2026-84350

CVE-2026-84350 is a use-after-free (CWE-416) in the TabStrip component of Google Chrome, fixed in version 152.0.7977.75. A remote attacker can trigger the flaw by using social engineering to get a victim to perform specific UI interactions in the browser. Successful exploitation allows arbitrary code execution outside the browser sandbox, which increases the potential impact compared to typical renderer-sandboxed bugs. All users running Google Chrome versions prior to 152.0.7977.75 are affected. Exploitation status is quiet: no public proof-of-concept is known, the flaw is not in CISA's KEV catalog, EPSS estimates only a 0.2% chance of exploitation within 30 days, and Chromium rates the underlying severity as Low despite the CVSS 3.1 score of 8.8 (High).

What to do: Update Google Chrome to 152.0.7977.75 or later, which contains the TabStrip fix, and verify enterprise fleets have completed the auto-update cycle. Because exploitation relies on social engineering and UI interaction, remind users to be cautious with prompts urging unusual browser interactions. There is no known active exploitation or public exploit, so routine patching is sufficient.