--- title: Sandbox ESCAPE in Chrome | daily.dev description: Google issued an emergency patch for Chrome's first zero-day of 2026, tracked with a CVSS score of 8.8. The flaw is a use-after-free bug in Chrome's CSS... canonical: https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sandbox ESCAPE in Chrome | daily.dev og:description: Google issued an emergency patch for Chrome's first zero-day of 2026, tracked with a CVSS score of 8.8. The flaw is a use-after-free bug in Chrome's CSS... og:url: https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak og:image: https://api.daily.dev/og/posts/pLoVZlNAk.png og:image:alt: Sandbox ESCAPE in Chrome og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sandbox ESCAPE in Chrome **[David Bombal](https://daily.dev/sources/davidbombal)** · 2 min read · 0 upvotes · 0 comments ## Summary Google issued an emergency patch for Chrome's first zero-day of 2026, tracked with a CVSS score of 8.8. The flaw is a use-after-free bug in Chrome's CSS handling that allows remote attackers to execute arbitrary code inside the browser sandbox via a malicious HTML page. Exploits were already active in the wild just two days after the vulnerability was reported on February 11th. Additionally, 287 Chrome extensions with tens of millions of installs were found quietly harvesting users' browsing histories, reinforcing warnings about the risks of installing unvetted browser extensions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#google-chrome](https://daily.dev/tags/google-chrome), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sandbox ESCAPE in Chrome","url":"https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak"},"datePublished":"2026-02-22T16:58:16.210Z","dateModified":"2026-02-22T16:58:50.390Z","description":"Google issued an emergency patch for Chrome's first zero-day of 2026, tracked with a CVSS score of 8.8. The flaw is a use-after-free bug in Chrome's CSS...","image":"https://i.ytimg.com/vi/GD5Xp0KQkiE/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/GD5Xp0KQkiE/sddefault.jpg","isAccessibleForFree":true,"articleSection":"David Bombal","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"David Bombal","logo":"https://media.daily.dev/image/upload/s--Dz6oUxSb--/f_auto/v1710503980/logos/davidbombal","url":"https://daily.dev/sources/davidbombal"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sandbox-escape-in-chrome-plovzlnak","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,vulnerability,google-chrome,zero-day","timeRequired":"PT2M","video":{"@type":"VideoObject","name":"Sandbox ESCAPE in Chrome","description":"Google issued an emergency patch for Chrome's first zero-day of 2026, tracked with a CVSS score of 8.8. The flaw is a use-after-free bug in Chrome's CSS...","thumbnailUrl":"https://i.ytimg.com/vi/GD5Xp0KQkiE/sddefault.jpg","uploadDate":"2026-02-22T16:58:16.210Z","duration":"PT2M","url":"https://api.daily.dev/r/pLoVZlNAk","embedUrl":"https://www.youtube.com/embed/GD5Xp0KQkiE"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"David Bombal","item":"https://daily.dev/sources/davidbombal"},{"@type":"ListItem","position":3,"name":"Sandbox ESCAPE in Chrome"}]} ```