CVE-2026-79045: Google Chrome V8 Information Disclosure

CVE-2026-79045 Overview

CVE-2026-79045 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page, then read memory contents inside the Chrome sandbox. The flaw is tracked as CWE-843: Access of Resource Using Incompatible Type. While Chromium rates the security severity as Low, NVD assigns the issue a higher score due to the network attack vector and potential impact when combined with other techniques.

Critical Impact
Successful exploitation permits a remote attacker to read sensitive memory within the Chrome renderer sandbox through a crafted web page.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable V8 builds
Desktop Chrome across Windows, macOS, and Linux stable channels

Discovery Timeline

2026-08-25 - CVE-2026-79045 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79045

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when code allocates or accesses a resource using one type but later interprets it as an incompatible type. In V8, this typically stems from optimizer assumptions about object shapes or hidden classes that no longer hold at runtime.

The result is that JavaScript executing on a malicious page can coerce V8 into treating one object layout as another. This allows the attacker to reach adjacent memory regions and exfiltrate their contents. According to the NVD description, exploitation requires user interaction, matching the UI:R component of the CVSS vector.

Because the read is bounded by the renderer sandbox, the primary impact is information disclosure rather than direct code execution. However, memory disclosure primitives frequently serve as building blocks for full sandbox escapes when chained with additional bugs.

Root Cause

The root cause is incorrect type handling within V8's object model. The engine treats a value as one type after it has been recycled or reshaped as another, breaking the invariants the just-in-time (JIT) compiler relies on. See the Chromium Issue Tracker #531245718 for upstream analysis.

Attack Vector

Exploitation begins with social engineering. An attacker lures the victim to a crafted HTML page that hosts malicious JavaScript. When the page loads, the script triggers the type confusion condition in V8 and reads adjacent sandbox memory. No authentication is required, and the delivery channel is the open web.

No verified public proof-of-concept is available. Refer to the Google Chrome Stable Channel Update for vendor commentary.

Detection Methods for CVE-2026-79045

Indicators of Compromise

Chrome renderer processes crashing with signatures pointing to V8 or v8::internal frames after visiting untrusted pages
Outbound network connections from browser sessions to newly registered or low-reputation domains hosting heavy JavaScript
Browser telemetry showing Chrome versions below 152.0.7977.65 in the fleet after the patch release date

Detection Strategies

Inventory installed browser versions across managed endpoints and flag hosts running Chrome builds prior to 152.0.7977.65
Correlate web proxy logs with endpoint telemetry to identify users visiting URLs delivered through phishing or malvertising campaigns
Monitor for anomalous child processes spawned from chrome.exe following visits to untrusted domains

Monitoring Recommendations

Ingest Chrome crash reports and renderer exit codes into centralized logging for trend analysis
Alert on privileged users browsing to uncategorized or newly seen domains from unpatched workstations
Track browser update compliance via management tooling such as Chrome Browser Cloud Management

How to Mitigate CVE-2026-79045

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on user workstations to ensure the patched binary is loaded into memory
Audit Chromium-based applications and browsers for embedded V8 versions and apply vendor updates

Patch Information

Google addressed the vulnerability in the Chrome stable channel release documented in the Google Chrome Stable Channel Update. The fix ships in Chrome 152.0.7977.65 and later. Enterprises using Chrome Browser Cloud Management should push the update through the standard channel with the update rollout policy set to expedite deployment.

Workarounds

Enforce strict site isolation and block execution of JavaScript on untrusted domains via enterprise browser policy
Restrict browsing to categorized sites through a secure web gateway until patching is complete
Deliver targeted awareness training reminding users not to follow links from unsolicited messages, since exploitation requires user interaction

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version