CVE-2026-79004: Google Chrome Media Use-After-Free Vulnerability

CVE-2026-79004 Overview

CVE-2026-79004 is an out-of-bounds read vulnerability [CWE-125] in the Media component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can read memory outside the sandbox by serving a crafted HTML page. Google's Chromium team classified the security severity as Medium.

The vulnerability requires an attacker to first gain code execution inside the renderer. Successful exploitation exposes memory contents from outside the sandbox boundary, enabling information disclosure that can support further exploit chains.

Critical Impact
Attackers with a compromised renderer can read memory outside the Chrome sandbox, leaking sensitive process data usable for sandbox escape chains.

Affected Products

Google Chrome Desktop (Stable channel) prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable Media component
Downstream browsers built on pre-152 Chromium (Edge, Brave, Opera, Vivaldi) until rebased

Discovery Timeline

2026-08-25 - CVE-2026-79004 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79004

Vulnerability Analysis

The vulnerability resides in the Media subsystem of Chrome, which handles decoding and playback of audio and video content. An out-of-bounds read [CWE-125] occurs when code accesses buffer memory beyond the allocated range. In this case, a crafted HTML page containing malformed media data triggers the condition.

The read primitive is usable only from an already-compromised renderer process. This positions CVE-2026-79004 as a secondary-stage bug useful for leaking pointers, canaries, or sandboxed process memory. Attackers commonly pair such reads with a separate sandbox-escape primitive to achieve full compromise.

The EPSS score is 0.288% with a percentile of 20.779, reflecting low near-term exploitation probability at publication.

Root Cause

The root cause is missing or incorrect bounds validation on a buffer access inside Chrome's Media pipeline. When the Media component parses attacker-controlled input from a crafted HTML page, it reads bytes beyond the intended buffer end. Google has not published detailed root-cause information. See the Chromium Issue Tracker #536428988 for restricted technical details.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the renderer process, typically through a separate memory corruption bug. Second, the attacker delivers a crafted HTML page that triggers the vulnerable Media code path. The out-of-bounds read then discloses memory contents outside the renderer sandbox, which the attacker uses to advance the exploit chain.

See the Google Chrome Stable Update for release-level context. No public proof-of-concept exploit is available.

Detection Methods for CVE-2026-79004

Indicators of Compromise

Chrome renderer processes crashing or generating unusual media-related error telemetry when visiting untrusted pages
Outbound connections from browser processes to newly registered or low-reputation domains hosting media content
Unexpected child processes spawned by chrome.exe following media playback

Detection Strategies

Inventory Chrome installations across the fleet and flag any build below 152.0.7977.65
Correlate browser crash reports with URLs visited to surface potential exploitation attempts
Monitor endpoint telemetry for anomalous memory access patterns or renderer sandbox violations

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version and crash data
Track process-level activity from browser child processes for privilege escalation attempts
Alert on downloads or executions initiated by browser processes immediately after media content is served

How to Mitigate CVE-2026-79004

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Restart Chrome after the update to ensure the patched binary is loaded
Apply corresponding updates to Chromium-based browsers as vendors rebase

Patch Information

Google addressed CVE-2026-79004 in Chrome Stable 152.0.7977.65. Deploy the fix through the Chrome auto-update channel or enterprise management tooling. Reference the Google Chrome Stable Update advisory for release details and the Chromium Issue Tracker #536428988 for the tracked issue.

Workarounds

Restrict user browsing to trusted sites via web filtering until patches are deployed
Disable autoplay and block untrusted media sources through enterprise policy
Enforce Site Isolation and ensure the sandbox is not disabled via command-line flags

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enforce minimum Chrome version via enterprise policy (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v MinimumBrowserVersion /t REG_SZ /d "152.0.7977.65" /f