CVE-2026-78937: Google Chrome Use-After-Free Vulnerability

CVE-2026-78937 Overview

CVE-2026-78937 is a use-after-free vulnerability in the Search component of Google Chrome on Android versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into loading a crafted HTML page, potentially executing arbitrary code outside the Chrome sandbox. The flaw is classified under CWE-416: Use After Free and carries a network attack vector with required user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the affected mobile device.

Critical Impact
Arbitrary code execution outside the Chrome sandbox on Android devices via a crafted HTML page and user interaction.

Affected Products

Google Chrome on Android prior to 152.0.7977.65
Google Android platform (Chrome browser installations)
Chromium-based components relying on the vulnerable Search subsystem

Discovery Timeline

2026-08-25 - CVE-2026-78937 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78937

Vulnerability Analysis

The vulnerability resides in the Search component of Google Chrome on Android. A use-after-free condition occurs when the browser continues to reference memory that has already been freed. Attackers reclaim the freed memory region and control its contents, converting the dangling pointer into a primitive for arbitrary code execution.

Exploitation relies on a crafted HTML page combined with user interaction, typically driven by social engineering. Because Chrome on Android enforces a renderer sandbox, use-after-free bugs in this class of component are notable when they permit escape from the sandbox boundary. The advisory indicates that this flaw allows code execution outside the sandbox, elevating the effective impact beyond a standard renderer compromise.

Root Cause

The root cause is improper object lifetime management [CWE-416] within Chrome's Search functionality. Code paths retain a pointer to an object after its underlying memory has been released. Subsequent operations dereference that stale pointer, allowing attacker-controlled heap contents to influence control flow.

Attack Vector

The attack requires a remote user to visit a malicious or compromised web page rendered by an affected Chrome build on Android. The attacker delivers a crafted HTML payload that triggers the specific sequence of allocations, frees, and reuses required to reach the vulnerable state. User interaction such as clicking a link or engaging with a search-related UI element completes the exploitation chain.

No public proof-of-concept exploit or exploitation in the wild has been reported for CVE-2026-78937 at the time of publication. The EPSS score is 0.373% (percentile 30.119), reflecting a low near-term probability of observed exploitation.

See the Chromium Issue Tracker Entry for technical details as they become public.

Detection Methods for CVE-2026-78937

Indicators of Compromise

Android devices running Chrome versions earlier than 152.0.7977.65 that browsed unknown or untrusted domains
Unexpected Chrome renderer or browser process crashes on Android correlated with visiting external HTML content
Outbound connections from Chrome on Android to newly registered or low-reputation domains following a search or link click

Detection Strategies

Inventory Chrome versions across managed Android endpoints and flag any build below 152.0.7977.65
Monitor mobile telemetry for anomalous child process behavior or native code execution originating from Chrome
Correlate web proxy logs with URLs delivered via SMS, email, or messaging apps that immediately precede Chrome crashes

Monitoring Recommendations

Ingest Android MDM and browser update telemetry into a centralized data lake for continuous version compliance checks
Alert on Chrome for Android processes performing atypical file, network, or IPC activity outside standard renderer patterns
Track advisories from the Google Chrome Update Announcement channel for related follow-up patches

How to Mitigate CVE-2026-78937

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
Enforce automatic Chrome updates via Mobile Device Management (MDM) policies across the fleet
Communicate user guidance warning against clicking untrusted links or engaging with unexpected search prompts

Patch Information

Google released a fixed build in the stable channel. Reference the Google Chrome Update Announcement for full version details. Upgrading Chrome on Android to 152.0.7977.65 or later remediates CVE-2026-78937.

Workarounds

Restrict browsing on unpatched devices to a curated allowlist of trusted domains until the update is applied
Deploy MDM configuration profiles that block installation or launch of Chrome builds below the fixed version
Use an alternate, fully patched browser on Android endpoints where Chrome cannot be updated immediately

bash

# Verify Chrome for Android version via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should be 152.0.7977.65 or later