CVE-2026-79078: Google Chrome Use After Free Vulnerability

CVE-2026-79078 Overview

CVE-2026-79078 is a use-after-free vulnerability in the Federated Credential Management (FedCM) component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page, which triggers the use-after-free condition and allows arbitrary code execution outside the browser sandbox. The vulnerability is tracked under CWE-416 and carries a Chromium security severity of High.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox, giving attackers a direct path to compromise the underlying host from a single crafted web page.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Stable channel, Desktop)
Chromium-based builds incorporating the vulnerable FedCM implementation
All supported desktop platforms (Windows, macOS, Linux) shipping the affected Chrome release

Discovery Timeline

2026-08-25 - CVE-2026-79078 published to NVD
2026-08-27 - Last updated in NVD database
Vendor advisory - Chrome Releases Update
Issue tracker - Chromium Issue 548340637

Technical Details for CVE-2026-79078

Vulnerability Analysis

The vulnerability resides in Chrome's FedCM subsystem, which brokers federated identity flows between relying parties and identity providers directly in the browser. A use-after-free condition [CWE-416] occurs when FedCM code references a heap object after that object has been freed. An attacker who controls the lifecycle of the underlying object can place attacker-controlled data in the reclaimed memory region. When the dangling pointer is dereferenced, the resulting corrupted state can be shaped into arbitrary code execution.

Because FedCM is exposed to standard web content through JavaScript APIs, the attacker only needs the victim to load a crafted HTML page. The advisory states the resulting code execution occurs outside the sandbox, meaning the renderer's sandbox boundary is bypassed as part of the exploit chain. The scope change reflected in the CVSS vector aligns with the impact crossing the sandbox trust boundary.

Root Cause

The root cause is improper object lifetime management within FedCM. A pointer to a heap-allocated object remains reachable after the object is freed, and a subsequent operation reuses that pointer. Attackers who can influence allocations between the free and the use can groom the heap so that the freed slot is repopulated with attacker-chosen data before it is dereferenced.

Attack Vector

Exploitation is remote and requires user interaction, specifically visiting or interacting with a crafted page delivered by the attacker. The advisory notes that social engineering is required to route the target to attacker-controlled content, which is typical for browser-delivered exploits. No prior authentication is required. The vulnerability manifests during normal processing of FedCM API calls, so no privileged configuration is needed on the victim host.

Google has not released detailed exploitation artifacts, and no public proof-of-concept is currently listed in Exploit-DB or referenced in the vendor advisory. See the Chromium Issue Tracker Entry for technical details once access restrictions are lifted.

Detection Methods for CVE-2026-79078

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures shortly after navigation to an untrusted site invoking FedCM.
Unexpected child processes spawned by chrome.exe (Windows) or the Chrome helper process (macOS/Linux) following a browsing session.
Outbound connections from Chrome child processes to unfamiliar hosts immediately after page loads referencing FedCM endpoints.
Newly written executables or scripts in user-writable paths (e.g., %APPDATA%, ~/Library/Application Support) with Chrome as the parent process.

Detection Strategies

Inventory Chrome installations and flag any host running a version lower than 152.0.7977.65.
Monitor endpoint telemetry for anomalous process trees originating from browser processes, particularly code execution paths that escape typical renderer behavior.
Correlate browser crash telemetry (chrome_crashpad) with subsequent process creation or persistence events on the same host.

Monitoring Recommendations

Enable and forward Chrome enterprise reporting, including crash and extension telemetry, to your central logging platform.
Alert on Chrome child processes invoking shells (cmd.exe, powershell.exe, /bin/sh) or living-off-the-land binaries.
Track DNS and HTTP telemetry for domains hosting FedCM identity provider endpoints that do not match your approved identity provider allowlist.

How to Mitigate CVE-2026-79078

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints without delay.
Force a browser relaunch after the update so the patched binary is actually loaded into memory.
Verify Chromium-based downstream browsers (Edge, Brave, Opera, Vivaldi) have pulled in the corresponding Chromium fix before considering the fleet remediated.
Communicate social engineering awareness guidance, since exploitation requires the victim to load a crafted page.

Patch Information

Google addressed the vulnerability in the Stable channel desktop release documented in the Chrome Releases Update. Enterprise administrators should deploy the fix through Chrome Browser Cloud Management, Google Update policies, or their standard software distribution tooling. Confirm the running version by navigating to chrome://settings/help and validating the build is 152.0.7977.65 or newer.

Workarounds

Disable FedCM via enterprise policy where the feature is not required, using the FederatedCredentialManagementEnabled policy set to false.
Restrict browsing to trusted sites through web filtering or DNS controls until patching is complete.
Enforce site isolation and standard user privileges to reduce the blast radius if exploitation succeeds prior to patch deployment.

bash

# Configuration example: disable FedCM via Chrome enterprise policy (Linux)
# /etc/opt/chrome/policies/managed/disable_fedcm.json
{
  "FederatedCredentialManagementEnabled": false
}

# Verify installed Chrome version
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later