CVE-2026-78969: Google Chrome Video Information Disclosure

CVE-2026-78969 Overview

CVE-2026-78969 is an uninitialized resource vulnerability in the Video component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can read memory contents inside the Chrome sandbox by delivering a crafted HTML page to a victim. The Chromium security team rated the issue as Medium severity. The flaw is tracked under CWE-908: Use of Uninitialized Resource and referenced in Chromium Issue Tracker #504633668.

Critical Impact
A crafted HTML page can leak sandboxed memory contents from the Chrome renderer, potentially exposing sensitive in-process data useful for chaining with additional exploits.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Video component
Embedded browser components sharing the affected Chromium media stack

Discovery Timeline

2026-08-25 - CVE-2026-78969 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78969

Vulnerability Analysis

The vulnerability resides in Chrome's Video handling code. A resource is used before it is fully initialized, allowing residual memory contents to be read by attacker-controlled logic. Because the flaw operates inside the sandboxed renderer, attackers gain visibility into memory that should remain opaque to web content.

An attacker hosts a crafted HTML page that instantiates specific video processing paths. When the victim loads the page, the browser reads from the uninitialized resource. The disclosed bytes can include pointers, cryptographic material, or other artifacts that assist sandbox escape or renderer exploitation chains.

The EPSS probability is 0.338% with a percentile of 26.349, indicating a relatively low near-term exploitation likelihood. No public proof-of-concept or exploitation activity has been reported at the time of publication.

Root Cause

The root cause is classified as CWE-908: Use of Uninitialized Resource. A buffer or object within the Video pipeline is allocated but not zero-initialized or fully populated before its contents are consumed. Downstream code paths return this stale data to JavaScript-observable state, producing a memory disclosure primitive.

Attack Vector

Exploitation requires a victim to visit or be redirected to a malicious website. No authentication or user interaction beyond page navigation is required. The disclosure remains constrained by the renderer sandbox but provides information leakage useful for bypassing address space layout randomization (ASLR) or preparing follow-on exploits. See the Chrome Stable Channel Update for vendor-confirmed details.

No verified exploit code is publicly available. Technical specifics remain restricted while the Chromium issue tracker access remains gated.

Detection Methods for CVE-2026-78969

Indicators of Compromise

Unexpected outbound requests from Chrome renderer processes to unfamiliar domains hosting HTML with heavy video element manipulation
Chrome processes crashing or exhibiting anomalous memory access patterns while rendering third-party video content
Endpoint telemetry showing Chrome versions below 152.0.7977.65 still deployed after the patch release date

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 152.0.7977.65
Monitor web proxy and DNS logs for user visits to newly registered domains delivering HTML pages with unusual <video> or Media Source Extensions (MSE) usage
Correlate browser process telemetry with network egress to identify data exfiltration patterns following visits to untrusted sites

Monitoring Recommendations

Enable browser management policies that report installed browser versions to a central management console
Ingest endpoint and proxy logs into a centralized data lake for retrospective hunting once further technical details are released
Track updates on the Chromium Issue Tracker #504633668 as access restrictions are lifted

How to Mitigate CVE-2026-78969

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-close and relaunch Chrome after update deployment to ensure the patched binary is active
Audit Chromium-derived applications and embedded browser frameworks for equivalent upstream fixes

Patch Information

Google addressed the vulnerability in Chrome Stable Channel version 152.0.7977.65. Refer to the Chrome Stable Channel Update advisory for release notes. Enterprise administrators should deploy the update through their existing Chrome Browser Cloud Management or software distribution tooling.

Workarounds

Restrict browsing to trusted domains through URL filtering or DNS-layer policies until patches are applied
Disable autoplay for video content and block untrusted media sources via Content Security Policy where feasible
Isolate high-risk browsing to sandboxed or ephemeral virtual environments for users who cannot immediately update

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update via managed policy on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Google\Update" | Select-Object UpdateDefault

# macOS: trigger Chrome to check for updates
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --check-for-update-interval=1