CVE-2026-79072 Overview
CVE-2026-79072 is an improper state validation vulnerability in the Performance component of Google Chrome prior to version 152.0.7977.65. A remote attacker can exploit the flaw by serving a crafted HTML page, potentially reading memory contents inside the Chrome sandbox. Chromium engineers rated the security severity as High.
The issue is tracked under CWE-754: Improper Check for Unusual or Exceptional Conditions. It affects Chrome desktop channels and downstream Chromium-based browsers that share the same Performance code path.
Critical Impact
A crafted web page can leak memory from within the Chrome sandbox to a remote attacker without user interaction beyond visiting the page.
Affected Products
- Google Chrome for Desktop versions prior to 152.0.7977.65
- Chromium-based browsers embedding the vulnerable Performance component
- Downstream distributions and enterprise builds that have not merged the upstream fix
Discovery Timeline
- 2026-08-25 - CVE-2026-79072 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79072
Vulnerability Analysis
The vulnerability resides in Chrome's Performance component, which exposes timing and resource APIs to web content. Improper state validation permits code paths to operate on objects or measurements that are not in a consistent state. As a result, the renderer can return data derived from uninitialized or stale memory to the attacker's script context.
Because the flaw exposes memory inside the sandbox, an attacker cannot directly execute code on the host. Leaked bytes can, however, disclose pointers, tokens, or cross-origin content that assist follow-on exploitation. Memory disclosure primitives are frequently chained with sandbox escapes or renderer type confusions to build reliable browser exploits.
Root Cause
The defect maps to [CWE-754], where the code fails to verify that an operation's preconditions hold before acting on associated state. In Performance APIs this typically involves timing entries, resource records, or measurement buffers being accessed before initialization, after teardown, or during a transition. The mismatch between expected and actual state leads the API to return values sourced from adjacent memory.
Attack Vector
Exploitation requires the victim to load a crafted HTML page under attacker control. The page invokes specific sequences against the Performance interface to trigger the state mismatch and read back memory contents. No credentials or elevated privileges are required, and interaction beyond navigation is not needed.
Verified proof-of-concept code is not publicly available. Technical details are restricted in the Chromium Issue Tracker #528397177, and mitigations are described in the Chrome Blog Update Announcement.
Detection Methods for CVE-2026-79072
Indicators of Compromise
- Browser telemetry showing Chrome versions below 152.0.7977.65 after the patch release window
- Renderer processes reporting anomalous Performance API call sequences from untrusted origins
- Outbound requests to newly registered domains immediately after visits to unfamiliar sites
Detection Strategies
- Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag builds older than 152.0.7977.65.
- Correlate web proxy logs with endpoint browser telemetry to identify users visiting suspicious pages that then trigger unusual renderer memory patterns.
- Monitor for renderer crashes or sandbox anomalies that may indicate exploit development activity against Performance APIs.
Monitoring Recommendations
- Enable browser management reporting to a centralized log store and normalize records for version, extension inventory, and crash events.
- Alert on delayed patch adoption where Chrome updates lag more than seven days behind the stable channel release.
- Track EPSS movement for CVE-2026-79072 to detect exploit maturation, noting the current score of 0.224% at percentile 12.8.
How to Mitigate CVE-2026-79072
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later across all managed endpoints.
- Restart browser sessions after patch deployment to ensure the vulnerable renderer code is unloaded from memory.
- Audit third-party Chromium-based browsers and embedded WebViews for equivalent upstream fixes.
Patch Information
Google addressed the vulnerability in the Chrome Stable channel update at version 152.0.7977.65. Refer to the Chrome Blog Update Announcement for full release notes and the Chromium Issue Tracker #528397177 for triage metadata. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.
Workarounds
- Restrict browsing to trusted sites via enterprise URL allowlists until patches are deployed.
- Deploy site isolation policies and enforce strict content security policies to reduce the value of leaked memory.
- Disable or limit access to high-risk web categories through secure web gateways during the patch rollout window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
