CVE-2026-79047: Google Chrome Use After Free Vulnerability

CVE-2026-79047 Overview

CVE-2026-79047 is a use-after-free vulnerability in the Views component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can craft a malicious HTML page that, when combined with social engineering, executes arbitrary code outside the Chrome sandbox. The vulnerability is tracked under CWE-416 and impacts the browser's user interface framework rather than a rendering process, which explains the sandbox escape potential.

Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox on the victim's host, giving attackers the same privileges as the logged-in user.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable Views component
Downstream browsers that ship the affected Chromium branch

Discovery Timeline

2026-08-25 - CVE-2026-79047 published to NVD
2026-08-25 - Google publishes Stable Channel update advisory for Desktop
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79047

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition in Chrome's Views subsystem. Views is Chromium's cross-platform UI framework that renders browser windows, dialogs, menus, and other chrome elements. A UAF occurs when a program continues to reference memory after it has been freed, allowing an attacker who controls subsequent allocations to place attacker-influenced data at the dangling pointer's location.

Because Views runs in the browser process rather than a sandboxed renderer, arbitrary code execution triggered through this bug is not confined by Chrome's site isolation or sandbox boundaries. Google's Chromium team rates the security severity as High. Public technical details are limited pending broader patch adoption, and the Chromium issue tracker entry #517515945 remains restricted.

Root Cause

The root cause is improper object lifetime management inside a Views object. A reference to a UI object persists after the object has been destroyed, likely through an event handler, animation callback, or observer that outlives the underlying widget. Subsequent access dereferences the freed allocation, producing exploitable memory corruption when the slot is reused.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or compromised web page, which places social engineering at the center of the attack chain. The crafted HTML page triggers the specific sequence of Views operations needed to free and then reuse the vulnerable object. Because the flaw resides in the browser process, a successful primitive can bypass the renderer sandbox and lead to code execution in the user's security context.

No public proof-of-concept is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79047

Indicators of Compromise

Chrome browser process (chrome.exe, Google Chrome, or chrome) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after web browsing activity.
Unexpected crashes or watchdog restarts of the Chrome browser process on hosts still running versions prior to 152.0.7977.65.
Outbound connections from the Chrome process to non-standard hosts shortly after loading an untrusted page.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint below 152.0.7977.65 as vulnerable.
Alert on browser process trees that deviate from expected behavior, such as Chrome creating scripting hosts, dropping executables, or writing to autorun locations.
Correlate browser crash telemetry with network telemetry to identify hosts crashing after visits to newly registered or low-reputation domains.

Monitoring Recommendations

Forward endpoint process, file, and network telemetry to a centralized data lake to enable retrospective hunting once Google releases additional technical details.
Monitor for exploit-kit style redirect chains and drive-by download patterns targeting Chrome users.
Track Chrome update compliance as a continuous metric and generate alerts for hosts that fail to reach the patched build.

How to Mitigate CVE-2026-79047

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs; the fix does not take effect until the browser is relaunched.
Push the update through enterprise management tooling for managed fleets and verify version compliance across all users.

Patch Information

Google released the fix in the Stable Channel update announced on the Chrome Releases blog. See the Google Chrome Stable Channel Update for full advisory details. The Chromium issue is tracked at Chromium Issue Tracker #517515945 and remains access-restricted per Chromium disclosure policy.

Workarounds

No vendor-supplied workaround exists; patching to 152.0.7977.65 is the required remediation path.
Restrict browsing on unpatched hosts through web filtering and block newly registered or low-reputation domains until updates are complete.
Reinforce user awareness that this vulnerability requires interaction with a crafted page, and remind users to avoid untrusted links delivered via email, chat, or advertising.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# or on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv