CVE-2026-79056: Google Chrome Use After Free Vulnerability

CVE-2026-79056 Overview

CVE-2026-79056 is a use-after-free vulnerability in the ServiceWorker component of Google Chrome prior to version 152.0.7977.65. A remote attacker can exploit the flaw by luring a user to a crafted HTML page, potentially executing arbitrary code outside of the Chrome sandbox. The issue is tracked under CWE-416 and affects the Chromium rendering stack that ships with Chrome across Windows, macOS, and Linux desktop builds. Google addressed the flaw in the Stable channel update announced on the Chrome Releases blog.

Critical Impact
Successful exploitation grants remote code execution outside the Chrome sandbox, giving an attacker code execution in the context of the logged-in user.

Affected Products

Google Chrome Desktop for Windows prior to 152.0.7977.65
Google Chrome Desktop for macOS prior to 152.0.7977.65
Google Chrome Desktop for Linux prior to 152.0.7977.65

Discovery Timeline

2026-08-25 - CVE-2026-79056 published to the National Vulnerability Database
2026-08-27 - CVE-2026-79056 last modified in the NVD database

Technical Details for CVE-2026-79056

Vulnerability Analysis

The flaw is a use-after-free in the Chromium ServiceWorker implementation. Service workers are background scripts that intercept network requests and cache responses for web origins. The vulnerable code path frees a heap object while another execution context still holds a reference to it. When the dangling reference is later dereferenced, the attacker controls the memory that has been reclaimed. This gives the attacker a primitive suitable for building arbitrary read, write, and control-flow hijack.

The advisory notes that exploitation can escape the renderer sandbox. Sandbox escape means the attacker can influence the browser process or a privileged utility process, not only the renderer. Code executes in the security context of the current desktop user.

Root Cause

The root cause is improper object lifetime management inside the ServiceWorker subsystem. An object referenced across asynchronous boundaries is released before all holders release their references. Additional details are tracked in Chromium Issue #522418913, which remains restricted pending broad patch deployment.

Attack Vector

Exploitation is remote and requires user interaction. A victim must load an attacker-controlled HTML page in a vulnerable Chrome build. The malicious page registers or interacts with a service worker in a way that triggers the freed-object reuse. No authentication is required, and drive-by scenarios via advertising networks or watering-hole sites remain viable delivery methods.

No public proof-of-concept, exploit code, or in-the-wild activity has been reported at publication time. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79056

Indicators of Compromise

Chrome renderer or utility process crashes referencing content::ServiceWorker* frames in crash dumps or chrome://crashes.
Unexpected child processes spawned by chrome.exe such as cmd.exe, powershell.exe, or bash, indicating a possible sandbox escape.
Outbound connections from Chrome processes to newly registered or low-reputation domains hosting service worker payloads.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 152.0.7977.65.
Alert on browser processes writing executables to user-writable paths such as %APPDATA%, %LOCALAPPDATA%, or ~/Library.
Correlate browser crash telemetry with subsequent process creation events on the same host within a short time window.

Monitoring Recommendations

Ingest Chrome browser telemetry, EDR process trees, and DNS logs into a central analytics platform for cross-source correlation.
Track Google Chrome Stable channel release notes and map new CVEs to endpoint version compliance dashboards.
Monitor for anomalous service worker registrations by inspecting web proxy logs for repeated requests to /service-worker.js from uncommon origins.

How to Mitigate CVE-2026-79056

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update rolls out; the patch does not take effect until the browser process is relaunched.
Audit managed Chromium-based browsers and enterprise images to confirm they consume the fixed upstream release.

Patch Information

Google released the fix in the Chrome Stable channel update documented at the Chrome Releases blog. Administrators using Chrome Browser Cloud Management or Group Policy should validate that RelaunchNotification and update policies are enforced so endpoints receive the patched build.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
As a temporary measure, restrict browsing to trusted origins using enterprise URL allow-lists until the update is deployed.
Disable service workers on managed browsers only where compatibility testing confirms critical web applications continue to function.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell: query installed Chrome version
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enforce minimum version via Chrome Enterprise policy (JSON example)
# Place in the ManagedPreferences / registry policy store
{
  "BrowserSwitcherEnabled": false,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}