CVE-2026-79083: Google Chrome Media RCE Vulnerability

CVE-2026-79083 Overview

CVE-2026-79083 is a sandbox escape vulnerability in the Media component of Google Chrome prior to version 152.0.7977.65. The flaw stems from improper enforcement of behavioral workflow [CWE-841] within the browser's Media subsystem. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page. Google's Chromium team classifies the underlying issue as Medium severity, though the NVD assessment rates it higher due to the sandbox escape impact.

Critical Impact
An attacker with an existing renderer compromise can break out of the Chrome sandbox and execute code in the broader browser context, extending initial access to full host compromise.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Media component
Desktop stable channel builds across Windows, macOS, and Linux

Discovery Timeline

2026-08-25 - CVE-2026-79083 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79083

Vulnerability Analysis

The vulnerability resides in the Media component of Chrome and is categorized as improper enforcement of behavioral workflow [CWE-841]. The Media subsystem processes audio and video content and coordinates state transitions between the renderer and higher-privileged browser processes. When state transitions are not enforced in the expected order, an attacker can invoke privileged operations from a compromised renderer that should only be reachable through a sanctioned workflow.

Exploitation requires the attacker to first compromise the renderer process, typically through a separate memory corruption or logic bug. Once inside the renderer, the attacker uses a crafted HTML page to drive Media APIs into a disallowed state sequence and issue calls that cross the sandbox boundary. The result is potential arbitrary code execution outside the sandbox.

Root Cause

The root cause is missing or insufficient validation of workflow state within the Media component. Chrome's sandbox model assumes that renderer-to-browser IPC calls arrive in an approved order tied to a legitimate media session. The vulnerable code accepts requests without confirming the expected preconditions, allowing a compromised renderer to reach code paths intended for privileged callers.

Attack Vector

The attack is network-reachable and delivered through a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious site or loading attacker-controlled content in a frame. Attack complexity is high because the attacker must chain a prior renderer compromise with the workflow abuse to escape the sandbox. No verified public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Chromium Issue Tracker #519984038 for technical details as they become public.

Detection Methods for CVE-2026-79083

Indicators of Compromise

Chrome renderer or GPU processes spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or sh
Chrome browser process writing executable files to user-writable directories outside the normal profile paths
Outbound network connections from chrome.exe to previously unseen infrastructure shortly after loading media-heavy pages

Detection Strategies

Monitor Chrome process trees for parent-child anomalies where a renderer or media utility process launches shells or scripting hosts.
Alert on Chrome versions older than 152.0.7977.65 reported by endpoint inventory and browser telemetry.
Inspect crash telemetry from the Media component for repeated faults that may indicate exploitation attempts.

Monitoring Recommendations

Ingest browser version and patch-level data into your asset inventory to identify unpatched Chrome installations at scale.
Correlate web proxy logs with endpoint process events to trace which URLs preceded suspicious Chrome child-process activity.
Track Chromium stable channel release announcements and cross-reference deployed versions against the fixed build.

How to Mitigate CVE-2026-79083

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded on every user session.
Audit Chromium-based browsers and embedded WebViews for the same Media component version and patch accordingly.

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Stable Update. Enterprise administrators should validate that automatic updates have delivered 152.0.7977.65 or newer, and force update rollout through group policy or MDM where automatic updates are disabled.

Workarounds

Restrict access to untrusted websites through web filtering or DNS controls until patching is complete.
Enforce site isolation and disable unnecessary browser extensions to reduce the pre-conditions for a renderer compromise.
Deploy application allowlisting to block Chrome from spawning shells or scripting interpreters as child processes.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: force update check via registry-managed policy or
# navigate to chrome://settings/help to trigger the update