CVE-2026-79071: Google Chrome GPU Race Condition RCE Flaw

CVE-2026-79071 Overview

CVE-2026-79071 is a race condition vulnerability in the GPU component of Google Chrome prior to version 152.0.7977.65. An attacker who has already compromised the renderer process can exploit this flaw through a crafted HTML page to execute arbitrary code outside the browser sandbox. The issue is categorized under [CWE-367] Time-of-Check Time-of-Use (TOCTOU) race condition. Google has released a patched Chrome build in the Stable channel to address the flaw.

Critical Impact
Successful exploitation allows sandbox escape and arbitrary code execution on the host, giving an attacker full control over the user context outside Chrome's renderer sandbox.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based builds that ship the vulnerable GPU process code
All operating system platforms distributing pre-patch Chrome Stable channel builds

Discovery Timeline

2026-08-25 - CVE-2026-79071 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in the NVD database

Technical Details for CVE-2026-79071

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process, which handles graphics acceleration and interprocess communication with sandboxed renderers. A race condition [CWE-367] occurs when the GPU process validates a resource or state and then acts on it, allowing a concurrent operation to modify the referenced data between the check and the use. An attacker who already controls the renderer process can time GPU commands to trigger the race, corrupting memory or state in the higher-privileged GPU process. This turns a renderer-only compromise into full sandbox escape and arbitrary code execution outside the renderer boundary.

Root Cause

The root cause is a time-of-check to time-of-use flaw in GPU command handling. Shared state between the renderer and GPU process is not atomically validated and consumed, creating a window where a malicious renderer can substitute or mutate data after validation but before use.

Attack Vector

Exploitation requires a two-stage attack. The attacker first compromises the renderer process, typically via a separate vulnerability delivered through a crafted HTML page. The attacker then issues carefully timed GPU IPC messages to trigger the race in the GPU process, achieving code execution outside the sandbox. User interaction is required, since the victim must load the attacker's page.

No verified public proof-of-concept code is available. Refer to Chromium Issue #496292729 for the tracked technical details.

Detection Methods for CVE-2026-79071

Indicators of Compromise

Unexpected child processes spawned from chrome.exe or the GPU process (--type=gpu-process) with non-standard command lines or persistence behavior
Crash reports or GPU process terminations correlated with visits to untrusted web pages
Outbound network connections initiated by the GPU process to unfamiliar hosts, which is atypical for legitimate GPU workloads

Detection Strategies

Monitor Chrome process trees for anomalous parent-child relationships involving the GPU process, which should not spawn shells, scripting hosts, or arbitrary binaries
Alert on Chrome versions below 152.0.7977.65 reported by endpoint inventory or user-agent telemetry from proxies
Correlate browser crash telemetry with subsequent process creation or file write events on the same host within a short time window

Monitoring Recommendations

Ingest browser and endpoint process telemetry into a centralized analytics platform to detect sandbox escape patterns across the fleet
Track GPU process memory usage spikes and repeated crashes as a possible race exploitation signal
Enforce browser version compliance reporting and flag hosts running unpatched Chrome builds

How to Mitigate CVE-2026-79071

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints through enterprise update channels
Force Chrome to restart after the update so the patched binary is loaded into memory
Inventory the environment for outdated Chromium-based browsers and prioritize patching internet-facing user endpoints

Patch Information

Google addressed the flaw in the Chrome Stable channel release announced in the Google Chrome Desktop Update. Administrators should validate deployment through Chrome Browser Cloud Management, Group Policy, or their MDM solution. Tracking details are available at Chromium Issue #496292729.

Workarounds

Restrict browsing to trusted sites and block high-risk web categories at the web proxy or secure web gateway until patches are deployed
Disable GPU hardware acceleration in Chrome as a temporary risk reduction, understanding this degrades performance and does not fully eliminate exposure
Apply site isolation and enforce strict enterprise policies that limit exposure to untrusted HTML content

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy to disable GPU acceleration as a temporary workaround
# Windows Group Policy: Computer Configuration > Administrative Templates > Google > Google Chrome
# Set "Use hardware acceleration when available" to Disabled