CVE-2026-7910 is a use after free in Views in Google Chrome before 148.0.7778.96. An attacker who has already compromised the renderer process could bypass site isolation with a crafted page. Chromium rates it High. Update Chrome to 148.0.7778.96 or later and relaunch.
What's affected
- Product: Google Chrome on Windows, macOS and Linux.
- Affected: versions before 148.0.7778.96.
- Fixed: 148.0.7778.96 (Linux), and 148.0.7778.96 or .97 on Windows and Mac, per the Stable Channel update of 5 May 2026.
- Weakness: CWE-416, use after free.
- Score: NVD lists CVSS 9.6, while Chromium rates the issue High. Not listed in CISA KEV.
The attacker needs a compromised renderer process first, so this is a second stage bug. It matters as part of a chain.
How to check if you're exposed
Open chrome://version in the browser and read the version number. It should be 148.0.7778.96 or higher. If you manage fleets, check your management console for the reported Chrome version across devices.
Chrome applies updates at relaunch, so a browser that has been open for days may be downloaded but not running the fix. On Linux you can check from a shell.
google-chrome --version
Other Chromium based browsers ship the same fix on their own schedules, so check each one.
What to do now
- Update Chrome to 148.0.7778.96 or later, through Help, About Google Chrome, or your management tool.
- Relaunch the browser, since the fix applies only after restart.
- Push the update to managed fleets and check reported versions.
- Check Edge, Brave and other Chromium based browsers, and Electron apps, for their own fixed releases.
Why it matters
A use after free is memory that is used after it has been released. In Views, the browser's UI toolkit code, this one lets an attacker who controls the renderer get past site isolation, the wall that keeps one site's data out of another site's process.
The record says it needs a compromised renderer, so it is not a first step attack. Browsers get exploited in chains, so keep them current, and treat the relaunch as part of the patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to restart Chrome?
Yes. The fixed version runs only after the browser relaunches.
Is this exploited in the wild?
The record does not mark it as a CISA KEV entry, and the Chrome release post does not claim it.
Sources
Last reviewed: 19 October 2026.
