Chrome CVE-2026-126902: A Mac Sandbox Escape in the Browser Process, Fixed in 157.0.8103.78 Alongside 82 Other Security Bugs

Cyber · 2026-11-12 · By H.A

A high-severity incorrect reference resolution flaw lets a compromised renderer run code outside Chrome's sandbox on macOS; update to 157.0.8103.78/.79 and relaunch.

Overview

Google has fixed CVE-2026-126902, a high-severity sandbox escape in Chrome for macOS. It's in the privileged Browser process, the part of Chrome that runs outside the sandbox. An attacker who already controls a compromised renderer can use it to run arbitrary code outside the sandbox.

The fix is in Chrome 157.0.8103.78, released to the Stable channel on November 11, 2026, as 157.0.8103.78/.79 for Windows and Mac and 157.0.8103.78 for Linux. It's one of an unusually large batch: by our count, the official CVE records list 83 security fixes for this version, 5 rated Critical and 78 High.

The Vulnerability

• CVE: CVE-2026-126902
• Weakness: Incorrect reference resolution (CWE-706)
• Component: Browser (the privileged browser process)
• Platform: Google Chrome on macOS
• Affected: Chrome for Mac before 157.0.8103.78
• Chromium severity: High
• CVSS: Not yet scored by NVD
• Exploitation: No reports of exploitation in the wild; not in CISA's Known Exploited Vulnerabilities catalog

CWE-706 means software resolves a name or reference to the wrong resource. Here the browser process, which runs with the user's full privileges, can be steered by a crafted HTML page into acting on the wrong object or resource. Google hasn't published the technical details and the bug report is still restricted, which is normal while users update.

Why a Sandbox Escape Matters

Chrome splits its work across processes. Web content is handled by renderer processes, which are locked inside a tight sandbox, so a bug in JavaScript or page rendering normally gives an attacker control of a heavily restricted process and nothing more. The browser process runs outside that sandbox with the user's normal permissions on the Mac.

That's why serious Chrome attacks are usually chains:

1. Renderer bug: a flaw in V8, Skia, CSS or layout gives code execution inside the sandbox.
2. Sandbox escape: a second flaw, like CVE-2026-126902, lets that compromised renderer break into the browser process.
3. Payload: with the sandbox gone, the attacker can read files, install malware or move on to the operating system.

The description's condition, "a remote attacker who had compromised the renderer process", isn't a reason to relax. It describes the second link of a full remote chain, and this same release fixes dozens of first-link bugs.

The Rest of the Release

CVE-2026-126902 shares the update with a long list of other memory-safety and logic bugs:

• Critical: use-after-free flaws in ServiceWorker (CVE-2026-126885, code execution outside the sandbox), CSS (CVE-2026-126895), Accessibility (CVE-2026-126911), Layout (CVE-2026-126879) and Skia on Android (CVE-2026-126846, outside the sandbox)
• V8 and Skia account for 34 of the 83 fixes between them: type confusions, out-of-bounds reads and writes, use-after-frees and cross-origin data leaks
• 27 fixes are described as allowing code execution or memory access outside the sandbox
• Other Mac-specific fixes: an out-of-bounds read in Skia (CVE-2026-126871) and a race condition in Extensions (CVE-2026-126906)
• Windows-specific fixes include an ANGLE origin-policy bypass (CVE-2026-126903) and a use-after-free in Core (CVE-2026-126883)

This comes days after Chrome 157.0.8103.50 patched an actively exploited zero-day. Two security updates in quick succession is a good reason to check that browsers have actually restarted on the new version.

Who Is Affected

• Chrome for macOS before 157.0.8103.78 is affected by CVE-2026-126902
• Chrome on Windows, Linux and Android is affected by other bugs in the same release
• Chromium-based browsers such as Microsoft Edge, Brave, Opera and Vivaldi share most of this code and will need their own updates. Watch for their releases built on Chromium 157.0.8103.78.

Recommended Actions

For users

• Open Chrome › About Google Chrome. Make sure the version is 157.0.8103.78 or later (.79 on Mac and Windows), then click Relaunch. The update doesn't take effect until Chrome restarts.
• Update other Chromium-based browsers as soon as their vendors ship the matching fix.

For IT and security teams

• Push 157.0.8103.78/.79 through your managed update tooling and enforce a relaunch deadline, for example with Chrome's RelaunchNotification and RelaunchNotificationPeriod policies.
• Use your inventory to find Mac endpoints that are still on an older build. Long-running browser sessions are the usual reason for lagging.
• Keep extension allow-lists tight. Several fixes in this release need a compromised renderer or social engineering to reach.
• Track Edge and other Chromium browsers separately. They patch on their own schedules.

Analyst Assessment

There's no evidence that CVE-2026-126902 has been exploited, and on its own it can't be triggered without a renderer compromise. Even so, a sandbox escape in Chrome's most privileged process on macOS is exactly the kind of bug that commercial exploit developers and spyware vendors look for. With dozens of renderer-side bugs fixed at the same time, 157.0.8103.78 is a patch-now update, not one to leave for the next maintenance window.