PatchDayAlert
Subscribe →
Daily Digest · 2 min read · 5 CVEs · Issue 07 By PatchDayAlert

Chrome sandbox escape chain, a WattBox sticker-to-root bug, and a dead Apache project

Two Chrome use-after-free bugs (CVE-2026-7343 + CVE-2026-7341, both CVSS 9.8) chain renderer compromise to full sandbox escape on Windows. Snap One WattBox 800/820 PDUs authenticate diagnostics endpoints with the MAC address printed on the label. Apache Pony Mail (Lua) has a 9.8 account takeover with no fix coming because the project is retired.

Patch now
2
Within 24h
2
This week
1
Exploited
0
ChromeMicrosoftBrowserWindowsApache Pony MailWeb AppWattBoxNetwork ApplianceLinux KernelLinux

Five CVSS 9.8s dropped today, none exploited in the wild yet, but don't let that make you comfortable. The headliner is a Chrome sandbox escape (CVE-2026-7343) that chains nicely with a WebRTC renderer bug to give attackers a full breakout path. Sandbox escapes get weaponized fast, so push Chrome updates to your fleet now.

Today's CVEs

Sorted by urgency

01

CVE-2026-7343

NVD
9.8
CVSS
Patch within 24h CRITICAL
ChromeMicrosoftBrowserWindows

A use-after-free bug in Chrome's Views component on Windows lets an attacker who already controls the renderer process break out of the sandbox. That's the escalation path from "running code in Chrome's jail" to "running code on the host." CVSS 9.8, not yet exploited in the wild, but sandbox escapes get weaponized fast.

Affected estate
Anyone managing Windows desktops or servers running Google Chrome (or Chromium-based browsers) below version 147.0.7727.138

Evidence trail

02

CVE-2026-7341

NVD
9.8
CVSS
Patch within 24h CRITICAL
ChromeBrowser

A use-after-free in Chrome's WebRTC stack lets an attacker run arbitrary code inside the browser sandbox by getting a user to visit a malicious page. The sandbox limits the blast radius, but this still gives an attacker a foothold, and it pairs nicely with CVE-2026-7343 above for a full escape. CVSS 9.8, no known exploitation yet.

Affected estate
Anyone managing endpoints running Google Chrome or Chromium-based browsers below version 147.0.7727.138, on any OS

Evidence trail

03

CVE-2026-41873

NVD
9.8
CVSS
Patch now CRITICAL
Apache Pony MailWeb App

The Lua version of Apache Pony Mail has an HTTP request smuggling bug that lets an attacker take over admin accounts. Here's the catch: the project is retired and there will be no fix. The replacement ("Pony Mail Foal," written in Python) isn't affected but also isn't officially released yet. CVSS 9.8.

Affected estate
Anyone still running the Lua-based Apache Pony Mail instance

Evidence trail

04

CVE-2026-41446

NVD
9.8
CVSS
Patch now CRITICAL
WattBoxNetwork Appliance

Snap One WattBox 800 and 820 series power distribution units have hidden diagnostic HTTP endpoints that "authenticate" using only the device's MAC address and service tag. Both values are printed on the physical label. Anyone who can read the sticker (or a photo of it) gets root command execution on the device. CVSS 9.8.

Affected estate
Facilities teams, AV integrators, and MSPs managing Snap One WattBox 800 or 820 series units with firmware below 2.10.0.0

Evidence trail

05

CVE-2026-31669

MSRC
9.8
CVSS EPSS 0.07%
Patch this week CRITICAL
Linux KernelLinux

A use-after-free in the Linux kernel's MPTCP connection lookup code can be triggered over the network. The CVSS is 9.8, but the EPSS score is very low (0.00068, 21st percentile), suggesting real-world exploitation is unlikely right now. Still, kernel-level memory corruption bugs deserve quick attention.

Affected estate
Teams running Azure Linux 3.0 (kernel 6.6.130.1-3) or CBL Mariner 2.0 (kernel 5.15.202.1-1), and anyone running upstream Linux kernels with MPTCP enabled

Evidence trail

One email, every Wednesday morning.

Subscribe

From the field notes

From this beat

Read the rest of the field notes →