CVE-2026-79069: Google Chrome Tint RCE Vulnerability

CVE-2026-79069 Overview

CVE-2026-79069 is a memory corruption vulnerability in the Tint component of Google Chrome on macOS. Tint is the WebGPU Shading Language (WGSL) compiler used by Chrome's graphics stack. The flaw affects Chrome versions on macOS prior to 152.0.7977.65 and allows a remote attacker to execute arbitrary code outside the browser sandbox through a crafted HTML page. Google's Chromium project rated the underlying issue as High severity.

Critical Impact
A remote attacker can achieve arbitrary code execution outside the Chrome sandbox on macOS by tricking a user into visiting a malicious web page.

Affected Products

Google Chrome for macOS prior to 152.0.7977.65
Apple macOS (as the host platform for the affected Chrome builds)
Chromium-based applications embedding vulnerable Tint/WebGPU code paths

Discovery Timeline

2026-08-25 - CVE-2026-79069 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79069

Vulnerability Analysis

The vulnerability resides in Tint, the WGSL compiler that Chrome uses to translate WebGPU shaders into GPU-executable code. Memory corruption in this component is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer. A crafted HTML page can supply a malicious shader or WebGPU workload that triggers the memory corruption during compilation or translation on macOS builds of Chrome. Successful exploitation leads to arbitrary code execution outside of the Chrome renderer sandbox, giving the attacker code execution in the context of the user running the browser.

Sandbox escape via a graphics or shader compiler is a high-value primitive because the compromised process typically runs with broader privileges than the renderer. Chained with a renderer-side bug, this class of flaw yields a full remote drive-by exploit. User interaction is required, consistent with visiting an attacker-controlled or compromised page.

Root Cause

The root cause is a memory safety defect within Tint's handling of WGSL inputs on macOS. Improper bounds checking or lifetime handling during shader translation allows attacker-controlled data to corrupt adjacent memory. Google has not published low-level technical details; see the Chromium Issue Tracker Entry for restricted references.

Attack Vector

Exploitation is network-based and requires the victim to load a crafted HTML page containing malicious WebGPU or WGSL content. No authentication is required. Because Tint runs outside the tightly restricted renderer sandbox, successful memory corruption can result in code execution with the privileges of the GPU or browser process rather than the sandboxed tab.

No verified proof-of-concept code has been published. Refer to the Google Chrome Update Announcement for vendor guidance.

Detection Methods for CVE-2026-79069

Indicators of Compromise

Chrome or Google Chrome Helper (GPU) processes on macOS spawning unexpected child processes such as bash, osascript, or curl.
Chrome GPU process crashes correlated with visits to untrusted sites, especially crashes referencing Tint or WebGPU frames.
Outbound network connections from Chrome helper processes to previously unseen or low-reputation domains.
Persistence artifacts under ~/Library/LaunchAgents/ created shortly after a browsing session on an untrusted page.

Detection Strategies

Inventory macOS endpoints running Chrome and flag any version below 152.0.7977.65 as vulnerable.
Alert on process lineage where Google Chrome Helper (GPU) is the parent of shell or scripting interpreters.
Correlate Chrome crash telemetry with browsing history to identify likely exploitation attempts against WebGPU.
Monitor for anomalous file writes to user-writable autostart locations originating from Chrome helper processes.

Monitoring Recommendations

Forward macOS EndpointSecurity process, exec, and file events to a central analytics platform for behavioral analysis.
Track Chrome version drift across the fleet using MDM or asset inventory to confirm patch coverage.
Enable browser crash reporting and review repeated GPU or Tint crashes as potential exploitation indicators.

How to Mitigate CVE-2026-79069

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later.
Restart Chrome after the update to ensure the patched binaries are loaded across all helper processes.
Prioritize patching for users who browse untrusted content or handle sensitive data on macOS.
Validate the deployed Chrome version through MDM reporting after rollout.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update for desktop. Install Chrome 152.0.7977.65 or later on macOS. See the Google Chrome Update Announcement for full release notes and channel details.

Workarounds

Disable WebGPU in Chrome by setting chrome://flags/#enable-unsafe-webgpu to Disabled where the feature is not required.
Restrict access to untrusted sites through DNS filtering or a secure web gateway until patches are applied.
Enforce Chrome auto-update policies via MDM so that stable-channel security fixes reach users without delay.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Enforce auto-update via defaults (example)
defaults write com.google.Keystone.Agent checkInterval 3600