CVE-2026-78991: Google Chrome Race Condition Vulnerability

CVE-2026-78991 Overview

CVE-2026-78991 is a race condition vulnerability in the WebProtect component of Google Chrome versions prior to 152.0.7977.65. The flaw allows a remote attacker who has already compromised the renderer process to obtain sensitive information through a crafted HTML page. Chromium classifies the security severity as Medium. The vulnerability is tracked under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition and requires user interaction for successful exploitation.

Critical Impact
An attacker with a compromised renderer process can leverage timing windows in WebProtect to leak sensitive browser data via a crafted HTML page.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable WebProtect component
All operating system builds of Chrome Stable prior to the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-78991 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78991

Vulnerability Analysis

The vulnerability resides in the WebProtect component of Google Chrome. WebProtect is responsible for enforcing security boundaries between web content and privileged browser resources. A race condition in this component allows an attacker to exploit a narrow timing window between security state validation and resource access.

Exploitation requires a prior compromise of the Chrome renderer process. From that foothold, the attacker delivers a crafted HTML page that triggers concurrent operations against WebProtect. The resulting inconsistency exposes sensitive information that should remain isolated by process boundaries.

The issue is a classic Time-of-check Time-of-use ([CWE-367]) pattern. Security state validated at one moment is acted upon later, after the state may have changed under concurrent execution.

Root Cause

The root cause is non-atomic handling of security-relevant state in WebProtect. The component checks a condition and then uses the associated resource without holding a lock or otherwise guaranteeing the state remained stable. Concurrent renderer-driven operations can mutate that state between the check and the use.

Attack Vector

The attack vector is network-based and requires user interaction, typically visiting a malicious or attacker-controlled page. The attacker must first compromise the renderer process, then serve a crafted HTML page designed to race WebProtect operations. Successful exploitation yields disclosure of sensitive information residing in the browser process context. Attack complexity is high because the attacker must reliably win the race window.

No public proof-of-concept exploit is currently listed for this issue. Technical details are tracked in the Chromium Issue Tracker #502888857.

Detection Methods for CVE-2026-78991

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 observed in endpoint inventory
Renderer process crashes or unexpected child-process spawning correlated with visits to untrusted domains
Anomalous inter-process communication patterns between renderer and browser processes referencing WebProtect operations

Detection Strategies

Inventory browser versions across managed endpoints and flag installations below 152.0.7977.65
Correlate web proxy logs with endpoint telemetry to identify users visiting pages that trigger repeated renderer crashes
Hunt for renderer-process exploitation precursors, such as unexpected V8 or Blink faults preceding data exfiltration attempts

Monitoring Recommendations

Deploy endpoint telemetry that captures browser child-process behavior, memory anomalies, and outbound network calls from renderer processes
Monitor DNS and HTTP egress for connections to newly registered or low-reputation domains delivering complex HTML payloads
Track Chrome update compliance continuously through configuration management tooling

How to Mitigate CVE-2026-78991

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binary is loaded across all user sessions
Audit Chromium-based enterprise browsers and downstream distributions for vendor advisories referencing this fix

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update advisory. Administrators should confirm rollout via enterprise update mechanisms such as Chrome Browser Cloud Management, group policy, or MDM configurations. Chromium-based browsers should be updated once their vendors incorporate the upstream fix.

Workarounds

Restrict browsing to trusted sites via enterprise URL filtering until patch deployment completes
Enable strict site isolation policies to reduce the impact of a compromised renderer process
Disable or limit high-risk web features on untrusted origins through Chrome enterprise policies

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Linux JSON policy)
# Place in /etc/opt/chrome/policies/managed/version-policy.json
{
  "BrowserSwitcherEnabled": false,
  "SitePerProcess": true,
  "IsolateOrigins": "https://*.trusted-corp.example",
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}