CVE-2026-78913: Google Chrome Use After Free Vulnerability

CVE-2026-78913 Overview

CVE-2026-78913 is a use-after-free vulnerability in the Chromoting component of Google Chrome versions prior to 152.0.7977.65. Chromoting powers Chrome Remote Desktop functionality. A remote attacker can send crafted network traffic to trigger memory corruption in the affected component. Successful exploitation may lead to arbitrary code execution outside the Chrome sandbox. The flaw is classified under CWE-416: Use After Free.

Critical Impact
Remote attackers can potentially execute arbitrary code outside the Chrome sandbox by delivering crafted network traffic to the Chromoting component, bypassing a key browser security boundary.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based builds embedding the vulnerable Chromoting component
Chrome Remote Desktop deployments running affected Chrome versions

Discovery Timeline

2026-08-25 - CVE-2026-78913 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78913

Vulnerability Analysis

The vulnerability resides in Chromoting, the component underlying Chrome Remote Desktop. Chromoting handles remote session negotiation, input, and streaming across a network channel. A use-after-free defect in this component allows memory to be referenced after it has been released. Attackers can shape heap state to place controlled data in the freed region. Dereferencing the stale pointer then transfers execution control to attacker-influenced memory.

Because Chromoting operates outside the renderer sandbox for portions of its work, successful exploitation can achieve code execution at a higher privilege boundary than a typical renderer bug. Google classifies the Chromium-side severity as Medium, but the NVD scoring reflects the potential sandbox escape. Exploitation requires the target to have Chromoting reachable and to process the crafted traffic. The high attack complexity reflects the memory-shaping and timing conditions required.

Root Cause

The root cause is an object lifetime error in Chromoting network message handling. A pointer to a heap object continues to be used after the owning allocation has been freed. Concurrent or reentrant paths in session processing can free the backing object while a caller still holds a reference. See Chromium Issue Tracker #523716748 for engineering details.

Attack Vector

An unauthenticated remote attacker delivers crafted network traffic to a client running vulnerable Chromoting code. The attacker does not need local access or user interaction beyond an active remote-desktop-adjacent state. Reliable exploitation requires precise heap grooming, which raises attack complexity. If achieved, the outcome is code execution outside the renderer sandbox.

No public proof-of-concept or exploit code is currently available. Refer to the Google Chrome Stable Update advisory for vendor context.

Detection Methods for CVE-2026-78913

Indicators of Compromise

Chrome processes (chrome.exe, remoting_host.exe, remoting_native_messaging_host) crashing with heap corruption signatures or spawning unexpected child processes
Chromoting host processes making outbound connections to unfamiliar signaling or relay endpoints
Post-exploit process lineage where a Chromoting-related process launches shells, script interpreters, or LOLBins
Unexpected persistence artifacts written by the Chrome Remote Desktop host user context

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65
Alert on abnormal child processes of chrome.exe and Chromoting host binaries, particularly command interpreters and network utilities
Correlate Chrome or Chromoting crash telemetry with subsequent outbound network activity from the same host
Baseline expected Chrome Remote Desktop usage and alert on activation on endpoints that do not normally run it

Monitoring Recommendations

Ingest endpoint process, module, and network telemetry into a centralized data lake for retrospective hunting across affected versions
Monitor for unsigned or unexpected modules loaded into Chrome or Chromoting processes
Track Chrome auto-update health and alert when hosts stall on outdated builds
Review firewall and proxy logs for anomalous connections to Chromoting relay infrastructure from non-typical endpoints

How to Mitigate CVE-2026-78913

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating to ensure the patched binaries are loaded into memory
Audit Chrome Remote Desktop deployments and disable Chromoting on endpoints that do not require it
Verify managed browser policies enforce automatic updates and block downgrade to vulnerable builds

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Details are published in the Google Chrome Stable Channel Update. Enterprise administrators should confirm rollout through Chrome Browser Cloud Management or their existing patch management tooling. Chromium-based downstream browsers should apply the corresponding upstream fix once available.

Workarounds

Disable or uninstall Chrome Remote Desktop where it is not operationally required until patching is complete
Restrict inbound and outbound network access to Chromoting signaling and relay endpoints via host-based or network firewalls
Enforce least privilege on user accounts running Chrome to limit the impact of a successful sandbox escape
Segment endpoints that must run Chrome Remote Desktop from sensitive network zones until updates are verified

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enforce minimum Chrome version via enterprise policy (example: macOS plist key)
# defaults write com.google.Chrome TargetVersionPrefix -string "152.0.7977.65"