CVE-2026-79073: Google Chrome Parser RCE Vulnerability

CVE-2026-79073 Overview

CVE-2026-79073 is an improper state validation vulnerability in the Parser component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires a victim to load a crafted HTML page, satisfying the user interaction requirement. Google classifies the Chromium security severity as Medium, while NVD scores the issue at 8.8 due to the network attack vector and high impact on confidentiality, integrity, and availability. The weakness maps to CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact
A remote attacker can achieve arbitrary code execution inside the Chrome sandbox by convincing a user to visit a malicious HTML page.

Affected Products

Google Chrome versions prior to 152.0.7977.65 on Desktop
Chromium-based builds sharing the vulnerable Parser component
Downstream browsers that have not integrated the Chromium fix

Discovery Timeline

2026-08-25 - CVE-2026-79073 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79073

Vulnerability Analysis

The vulnerability resides in Chrome's Parser component. The parser fails to properly validate internal state during processing of a crafted HTML document. This improper state validation creates conditions where the renderer processes data under assumptions that no longer hold true. An attacker who leverages the inconsistent state can steer execution flow inside the sandboxed renderer process. Successful exploitation grants code execution within the sandbox boundary, providing a foothold that is commonly chained with a sandbox escape to achieve full compromise of the host. Google's Chromium team rated the underlying issue Medium severity, but the network-reachable nature of browser parsing raises real-world exposure across enterprise fleets.

Root Cause

The defect is classified under CWE-754, improper check for unusual or exceptional conditions. Parser logic advances through document processing without verifying that prior state transitions completed as expected. Specific technical details are tracked in the restricted Chromium Issue Report #536662911 and remain embargoed pending broader patch adoption.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page on an attacker-controlled site or injects the payload into a compromised site. When a victim navigates to the page, the vulnerable parser processes the malicious markup and reaches the inconsistent state. No authentication or elevated privileges are required. The vulnerability is well-suited for drive-by download campaigns, malvertising, and phishing lures that deliver a link rather than an attachment. Because execution occurs inside the sandbox, adversaries typically pair this primitive with a sandbox escape to reach the host operating system.

No public proof-of-concept exploit is available at the time of publication. See the Chromium Issue Report #536662911 for technical tracking.

Detection Methods for CVE-2026-79073

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Renderer processes writing executables or scripts to disk under user-writable paths
Outbound connections from renderer processes to newly registered or low-reputation domains hosting HTML payloads
Browser telemetry showing Chrome versions below 152.0.7977.65 still in production use after the patch window

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build prior to 152.0.7977.65
Alert on anomalous process lineage where a Chrome renderer parents non-browser binaries or LOLBins
Correlate web proxy logs with EDR telemetry to identify users who visited suspect HTML content preceding renderer anomalies
Hunt for memory-resident payloads inside long-lived renderer processes using behavioral rules aligned to MITRE ATT&CK technique T1189 (Drive-by Compromise)

Monitoring Recommendations

Forward Chrome browser telemetry, process creation, and network events to a central data lake for cross-source correlation
Enable enterprise browser reporting through Chrome Enterprise policies to capture crash and safe-browsing signals
Track patch compliance dashboards weekly until fleet coverage on 152.0.7977.65 or later exceeds 99 percent

How to Mitigate CVE-2026-79073

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after update deployment to ensure the patched binary is loaded across all sessions
Push the fix through managed update channels such as Chrome Enterprise, Intune, Jamf, or your configuration management platform
Audit any Chromium-based applications and embedded browser frameworks for downstream patch availability

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Channel Update. Upgrading to 152.0.7977.65 or later remediates the improper state validation in the Parser component. Verify the installed version via chrome://settings/help or through your endpoint management platform.

Workarounds

Restrict browsing to trusted sites through DNS filtering or secure web gateway policies until patching completes
Enable Chrome Site Isolation and enforce Enhanced Safe Browsing via enterprise policy to reduce exposure
Deploy application allowlisting to block renderer processes from launching unauthorized child processes
Educate users to avoid unsolicited links and unfamiliar HTML attachments during the patch window

bash

# Verify the installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell: query installed Chrome version from the registry
Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon' | Select-Object version

# Example Chrome Enterprise policy fragment to enforce auto-update
# /etc/opt/chrome/policies/managed/update_policy.json
{
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true,
  "BrowserSignin": 2
}