CVE-2026-78990: Google Chrome Use After Free Vulnerability

CVE-2026-78990 Overview

CVE-2026-78990 is a use-after-free vulnerability in the Compositing component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can trigger the condition using a crafted HTML page. Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox. The issue is tracked under CWE-416 and requires user interaction, such as visiting a malicious website.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome sandbox by luring users to a crafted HTML page, enabling further browser compromise chains.

Affected Products

Google Chrome versions prior to 152.0.7977.65 on Desktop
Chromium-based browsers incorporating the vulnerable Compositing code
Embedded applications using unpatched Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-78990 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78990

Vulnerability Analysis

The vulnerability resides in the Compositing subsystem of Chrome, which is responsible for combining rendered layers before painting to the screen. A use-after-free condition [CWE-416] occurs when the compositor references a memory object that has already been freed. An attacker who controls the layout and lifetime of compositing objects through crafted HTML and JavaScript can force the renderer to dereference this freed memory. Controlled reuse of the freed allocation lets the attacker hijack execution flow inside the renderer process.

Exploitation results in arbitrary code execution inside the Chrome sandbox. While the sandbox limits direct system compromise, the flaw is commonly chained with a sandbox escape to achieve full host code execution. Chromium rates the internal severity as Medium, but NVD scoring reflects the network-reachable code execution impact.

Root Cause

The root cause is improper object lifetime management in the Compositing pipeline. A pointer to a compositor-managed object remains in use after the underlying memory is released. Follow-on operations dereference the stale pointer, leading to memory corruption. Details are tracked in Chromium Issue Tracker #501604761.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load a crafted HTML page controlled by the attacker. No authentication or elevated privileges are required. Common delivery methods include phishing links, malicious advertisements, and compromised websites that serve the exploit payload during a normal browsing session.

No public proof-of-concept or exploit code is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Google Chrome Desktop Update for vendor technical context.

Detection Methods for CVE-2026-78990

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures shortly after visiting external URLs
Unexpected child processes spawned from chrome.exe following web browsing sessions
Outbound connections from renderer processes to unknown domains hosting HTML with heavy WebGL or CSS animation content

Detection Strategies

Inventory endpoints running Chrome versions earlier than 152.0.7977.65 using software asset management tooling
Monitor for anomalous memory access patterns and crash telemetry from Chrome renderer processes
Correlate browser crash dumps with recent DNS and HTTP traffic to identify suspicious landing pages

Monitoring Recommendations

Alert on Chrome process crashes with exception codes indicating access violations in content.dll or compositor modules
Track process lineage where Chrome spawns unusual child processes such as command shells or scripting engines
Ingest browser and endpoint telemetry into a centralized SIEM for cross-source correlation of browser-based attack indicators

How to Mitigate CVE-2026-78990

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched binary is loaded into memory
Verify that Chromium-based browsers and embedded applications inherit the fixed version

Patch Information

Google released the fix in Chrome Stable channel version 152.0.7977.65. Administrators should deploy the update through enterprise management tools or allow Chrome's built-in updater to apply it. Full release details are available in the Google Chrome Desktop Update advisory.

Workarounds

Restrict browsing to trusted sites using enterprise web filtering until patches are deployed
Enable site isolation and enforce strict content security policies for managed Chrome installations
Deploy browser policies that block execution of untrusted JavaScript on high-risk endpoints

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on Linux
google-chrome --version

# Force update via enterprise policy (macOS example)
defaults write com.google.Keystone.Agent checkInterval 3600