CVE-2026-79012: Google Chrome Use After Free Vulnerability

CVE-2026-79012 Overview

CVE-2026-79012 is a use-after-free vulnerability in the Safebrowsing component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65 and is tracked under CWE-416. A remote attacker can trigger memory corruption by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google classifies the Chromium security severity as Critical. The vulnerability requires user interaction, making social engineering a prerequisite for exploitation.

Critical Impact
Remote attackers can escape the Chrome sandbox and execute arbitrary code on macOS hosts by luring users to a malicious HTML page.

Affected Products

Google Chrome for macOS versions prior to 152.0.7977.65
Apple macOS (any version supported by affected Chrome builds)
Chromium-based browsers sharing the affected Safebrowsing code path

Discovery Timeline

2026-08-25 - CVE-2026-79012 published to NVD
2026-08-27 - Last updated in NVD database
2026-08 - Google releases Chrome Stable channel update addressing the issue (Chrome Releases)

Technical Details for CVE-2026-79012

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition within Chrome's Safebrowsing subsystem, the component responsible for checking navigations and downloads against Google's threat intelligence lists. UAF flaws occur when a program continues to reference memory after it has been freed, allowing an attacker who controls the reallocated memory to hijack program flow.

Because Safebrowsing runs with elevated privileges relative to renderer sandboxes, exploitation grants code execution outside the sandbox on macOS. The attack requires user interaction: a target must load an attacker-controlled HTML page. Once triggered, the attacker can execute arbitrary code with the privileges of the Chrome browser process.

Google has withheld deep technical details in the public advisory, a standard practice while patch adoption ramps up. Additional context is tracked in Chromium Issue #523704817.

Root Cause

The root cause is improper object lifetime management in Safebrowsing code paths. An object reference remains reachable after the underlying allocation is released. Subsequent operations dereference the dangling pointer, enabling controlled memory writes or virtual function table hijacking.

Attack Vector

Exploitation is network-based and requires a user to visit a crafted HTML page. Attackers typically deliver such pages through phishing links, malvertising, or compromised sites. The scope is changed, meaning code execution occurs outside the renderer sandbox, expanding the impact beyond the browser process.

No verified public exploit or proof-of-concept is available at the time of publication. See the Chromium tracker for technical details as they are released.

Detection Methods for CVE-2026-79012

Indicators of Compromise

Chrome processes on macOS spawning unexpected child processes such as /bin/sh, osascript, or curl shortly after web navigation
Unexpected file writes under ~/Library/Application Support/Google/Chrome/ or persistence artifacts in ~/Library/LaunchAgents/
Outbound connections from Google Chrome Helper processes to newly registered or low-reputation domains
Crash reports referencing the Safebrowsing component in Chrome versions below 152.0.7977.65

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 152.0.7977.65
Alert on Chrome parent processes launching shell interpreters, scripting engines, or developer tools
Correlate browser crashes with subsequent anomalous process or network activity on the same host
Monitor for unsigned or unexpected binaries executed from Chrome cache and temporary directories

Monitoring Recommendations

Enable EDR telemetry for process creation, file writes, and network connections originating from Chrome helper processes
Ingest macOS Unified Logs and Chrome crash reports into the SIEM for retrospective hunting
Track Safebrowsing service errors and repeated renderer crashes as early indicators of exploitation attempts

How to Mitigate CVE-2026-79012

Immediate Actions Required

Update Google Chrome on macOS to version 152.0.7977.65 or later across all managed endpoints
Force browser restart after deployment to ensure the patched binary is loaded into memory
Restrict administrative privileges for standard users to limit post-exploitation impact
Reinforce user awareness on phishing and untrusted links, since exploitation requires user interaction

Patch Information

Google addressed CVE-2026-79012 in the Chrome Stable channel update for desktop. Administrators should deploy Chrome 152.0.7977.65 or later on macOS. Full details are available in the Google Chrome Stable Update advisory.

Workarounds

Enforce enterprise policy to auto-update Chrome and disable version pinning on affected macOS fleets
Deploy DNS and web filtering to block access to known malicious and newly registered domains
Isolate high-risk users behind a remote browser isolation solution until patching completes
Consider temporarily routing macOS users to an alternative, patched browser if Chrome updates cannot be deployed immediately

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update check via Google Software Update
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES