CVE-2026-79026: Google Chrome Use After Free Vulnerability

CVE-2026-79026 Overview

CVE-2026-79026 is a use-after-free vulnerability in the Extensions component of Google Chrome prior to version 152.0.7977.65. A remote attacker can leverage social engineering to convince a user to install or interact with a crafted Chrome extension. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google's Chromium team rated the security severity as High, and the NVD assigned a CVSS 3.1 base score of 9.6. The flaw is tracked as CWE-416 (Use After Free).

Critical Impact
Attackers can execute arbitrary code outside the Chrome sandbox on affected systems, breaking the browser's primary security boundary.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop Stable channel)
Chromium-based builds sharing the vulnerable Extensions code path
Enterprise deployments of Chrome that have not applied the August 2026 stable update

Discovery Timeline

2026-08-25 - CVE-2026-79026 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79026

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. It is a use-after-free condition, meaning code references memory after that memory has been released. An attacker who convinces a user to load a crafted extension can trigger the freed-object access at a controlled time. Because the Extensions process interacts with privileged browser components, successful exploitation can cross the sandbox boundary. The CVSS vector indicates network attack reach with required user interaction and scope change, consistent with a sandbox escape enabled through user-facing browser features.

Root Cause

Use-after-free defects [CWE-416] occur when an object is deallocated while other code paths still hold references to it. In this case, the Extensions component retains or reuses a pointer to memory that has been freed. Attacker-controlled extension logic can influence heap layout and reoccupy the freed region with attacker-crafted data. Subsequent dereferences then operate on adversary-controlled memory, enabling control-flow hijacking or type confusion.

Attack Vector

Exploitation requires social engineering. The attacker must persuade a target user to install a malicious Chrome extension or interact with attacker-supplied extension content. Once loaded, the crafted extension triggers the use-after-free in Chrome's Extensions handling. The scope-change indicator in the CVSS vector reflects that successful exploitation impacts resources beyond the initial vulnerable component, consistent with escaping the renderer or extension sandbox. No public proof-of-concept, exploit module, or CISA KEV listing has been recorded for this CVE at the time of writing. Refer to the Chromium Issue Tracker entry for further technical detail as Google releases it.

Detection Methods for CVE-2026-79026

Indicators of Compromise

Installation of Chrome extensions from outside the Chrome Web Store, or newly sideloaded extensions with broad permissions such as tabs, webRequest, or <all_urls> host access
Chrome renderer or utility processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Unexpected outbound connections initiated by chrome.exe to low-reputation domains shortly after extension installation
Chrome crash dumps referencing the Extensions component or heap corruption signatures around the disclosure window

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist
Alert on Chrome child-process creation chains that deviate from normal browser behavior, particularly script interpreters or LOLBins
Monitor endpoint EDR telemetry for anomalous memory allocation or module loads inside chrome.exe processes
Correlate browser version telemetry to confirm all endpoints run 152.0.7977.65 or later

Monitoring Recommendations

Ingest Chrome enterprise reporting and extension install events into a centralized SIEM or data lake for continuous review
Track outbound network activity from browser processes and baseline expected extension update endpoints
Enable crash reporting and forward Chrome crash telemetry to detect exploitation attempts that fail before achieving code execution

How to Mitigate CVE-2026-79026

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update completes so the patched binaries are loaded into memory
Audit installed extensions and remove any that are unknown, unused, or sourced from outside the Chrome Web Store
Enforce extension allowlisting through Chrome enterprise policy to block user-initiated installs of unvetted extensions

Patch Information

Google addressed CVE-2026-79026 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fixed version is 152.0.7977.65. Administrators should validate rollout using Chrome's built-in update mechanism or managed deployment tooling.

Workarounds

Disable third-party extensions using the ExtensionInstallBlocklist policy set to * and explicitly allow required extensions via ExtensionInstallAllowlist
Restrict extension installation sources to the Chrome Web Store using the ExtensionInstallSources policy
Deliver end-user awareness reminders warning against installing extensions from untrusted links or prompts

bash

# Windows Group Policy registry example: block all extensions except an explicit allowlist
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f