CVE-2026-78945 Overview
CVE-2026-78945 is a use-after-free vulnerability in the Views component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who convinces a user to visit a crafted HTML page can trigger memory corruption. Successful exploitation may allow arbitrary code execution outside the Chrome sandbox. The vulnerability is tracked under [CWE-416] and requires user interaction, typically through social engineering.
Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox by luring users to malicious HTML pages, enabling full browser compromise and potential host-level access.
Affected Products
- Google Chrome versions prior to 152.0.7977.65 (Desktop Stable channel)
- Chromium-based browsers sharing the vulnerable Views component
- Windows, macOS, and Linux Chrome desktop builds
Discovery Timeline
- 2026-08-25 - CVE-2026-78945 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78945
Vulnerability Analysis
The vulnerability resides in the Views subsystem of Chrome, which handles UI rendering primitives such as widgets, windows, and dialog elements. A use-after-free condition occurs when the browser references a Views object after its backing memory has been released. An attacker who controls the timing of object lifecycle events can reclaim the freed memory with attacker-influenced data.
The Chromium security team classified the underlying issue as Medium severity, but the NVD entry assigns a higher score because exploitation can break out of the renderer sandbox. Sandbox escape means attacker code executes with the privileges of the browser process, not the constrained renderer. This substantially widens the impact on the host operating system.
Exploitation requires user interaction. The victim must load a crafted HTML page, typically delivered via phishing, malvertising, or a compromised website.
Root Cause
Use-after-free defects in Views typically arise from lifetime mismatches between UI widgets and their observers or delegate pointers. When a Views object is destroyed while another component still holds a raw pointer, subsequent dereferences read or write freed heap memory. Attackers spray the heap to place controlled data at the freed address before the stale pointer is used.
Attack Vector
The attack chain begins with a crafted HTML page that manipulates DOM elements or browser UI in a way that triggers the vulnerable code path in Views. After freeing the target object, the attacker allocates controlled data into the same heap slot. Dereferencing the stale pointer then transfers control flow to attacker-supplied data, achieving code execution outside the renderer sandbox.
See the Chromium Issue Tracker Entry and the Chrome Release Update for vendor context.
Detection Methods for CVE-2026-78945
Indicators of Compromise
- Chrome renderer or browser process crashes with heap corruption signatures near Views symbols
- Unexpected child processes spawned by chrome.exe following visits to untrusted pages
- Outbound connections from Chrome to newly registered or low-reputation domains hosting HTML payloads
- Creation of persistence artifacts (scheduled tasks, run keys, LaunchAgents) shortly after browser activity
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65
- Alert on browser process anomalies such as unusual memory allocations, DEP or ASLR violations, and unexpected code execution in the browser process
- Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious HTML pages prior to browser crashes
Monitoring Recommendations
- Track Chrome auto-update status and enforce a minimum version policy through management tooling
- Monitor endpoint EDR telemetry for post-exploitation behavior originating from browser processes
- Ingest browser crash telemetry into centralized logging to identify clusters of Views-related faults
How to Mitigate CVE-2026-78945
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
- Restart browser sessions after applying the update to ensure the patched binary is loaded
- Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have absorbed the upstream fix before treating them as remediated
Patch Information
Google released the fix in the Chrome Stable channel update announced on 2026-08-25. Administrators should confirm deployment by validating that the reported version is 152.0.7977.65 or higher. Refer to the Chrome Release Update for the full advisory.
Workarounds
- Restrict browsing to trusted sites through URL filtering or DNS-based web protection until patching completes
- Enable Chrome Site Isolation and Enhanced Safe Browsing to reduce exploit reliability
- Deploy user awareness reminders about phishing links, since exploitation requires user interaction with a crafted HTML page
- Enforce least-privilege user accounts so that post-sandbox-escape code executes with limited host permissions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
