CVE-2026-79064: Google Chrome Use After Free Vulnerability

CVE-2026-79064 Overview

CVE-2026-79064 is a use-after-free vulnerability in the Network component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the issue through a crafted Chrome extension combined with social engineering to execute arbitrary code outside the browser sandbox. The vulnerability is tracked under CWE-416 and requires user interaction to trigger.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox on macOS hosts, breaking the primary browser containment boundary and exposing the underlying operating system.

Affected Products

Google Chrome for macOS versions prior to 152.0.7977.65
Apple macOS (as the host operating system)
Chromium-based deployments sharing the vulnerable Network component code path

Discovery Timeline

2026-08-25 - CVE-2026-79064 published to the National Vulnerability Database
2026-08-27 - Last updated in the NVD database

Technical Details for CVE-2026-79064

Vulnerability Analysis

The vulnerability resides in the Network component of Google Chrome, which handles resource fetching, request scheduling, and inter-process communication between the renderer and the network service. A use-after-free condition occurs when the component continues to reference memory that has already been released. Attackers who control the timing of allocations and frees can reclaim the freed region with attacker-controlled data. Once the stale pointer is dereferenced, execution can be redirected under attacker control. Because the Network component runs with broader privileges than the sandboxed renderer, a successful exploit escapes the Chrome sandbox on macOS.

Root Cause

The root cause is improper object lifetime management in the Network component, classified as [CWE-416]. An object is freed while another code path retains a reference to it. Subsequent operations on the dangling pointer allow memory reuse to be weaponized for control-flow hijacking or arbitrary read/write primitives.

Attack Vector

Exploitation is network-based but requires user interaction. An attacker must convince a target to install a crafted Chrome extension through social engineering. Once installed, the extension issues network operations that trigger the use-after-free path in the Chrome Network component. Successful exploitation executes code outside the renderer sandbox with the privileges of the Chrome network process on macOS. See the Chromium Issue Tracker Entry and the Chrome Desktop Update Announcement for vendor details.

No verified proof-of-concept code is publicly available for CVE-2026-79064.
Refer to the Chromium issue tracker and vendor advisory for technical specifics.

Detection Methods for CVE-2026-79064

Indicators of Compromise

Chrome browser processes on macOS spawning unexpected child processes such as /bin/sh, osascript, or curl shortly after extension installation events.
Newly installed Chrome extensions from untrusted or sideloaded sources, particularly those requesting broad webRequest or <all_urls> host permissions.
Unusual outbound network connections initiated by the Chrome network service to previously unseen domains.
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing the Chrome network service with heap corruption or EXC_BAD_ACCESS signatures.

Detection Strategies

Inventory installed Chrome extensions across managed macOS endpoints and correlate against approved allowlists using enterprise policy telemetry.
Alert on Chrome versions below 152.0.7977.65 reported by endpoint agents or software inventory tools.
Monitor for anomalous process lineage where Google Chrome Helper or the network service spawns non-browser binaries.

Monitoring Recommendations

Ingest macOS endpoint telemetry (process creation, file writes to extension directories, and network connections) into a centralized analytics pipeline for correlation.
Track Chrome auto-update status and flag hosts that fail to reach the fixed build within your patch SLA.
Review extension installation events sourced from outside the Chrome Web Store and quarantine unknown publishers.

How to Mitigate CVE-2026-79064

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later.
Audit installed Chrome extensions and remove any that are unsigned, sideloaded, or not on an approved allowlist.
Enforce enterprise policy to restrict extension installation to a curated allowlist via ExtensionInstallAllowlist and ExtensionInstallBlocklist.
Communicate the social-engineering vector to users, emphasizing that malicious extensions can escape the browser sandbox.

Patch Information

Google addressed the vulnerability in Chrome Stable channel build 152.0.7977.65 for macOS. Patch details are available in the Chrome Desktop Update Announcement. Administrators should confirm Chrome auto-update is functioning and validate the deployed version across the fleet.

Workarounds

Block installation of Chrome extensions from sources outside the Chrome Web Store using managed device policies until patching is complete.
Restrict Chrome extension permissions to the minimum required and disable developer mode on managed macOS devices.
Use application allowlisting on macOS to constrain what processes Chrome and its helpers can spawn.

bash

# Enforce Chrome extension allowlist via macOS managed preferences
defaults write com.google.Chrome ExtensionInstallBlocklist -array "*"
defaults write com.google.Chrome ExtensionInstallAllowlist -array \
  "<approved-extension-id-1>" \
  "<approved-extension-id-2>"
defaults write com.google.Chrome DeveloperToolsAvailability -int 2