CVE-2026-79097 Overview
CVE-2026-79097 is a use-after-free vulnerability [CWE-416] in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 on desktop platforms. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Successful exploitation compromises the confidentiality, integrity, and availability of the renderer process. Google classifies the Chromium security severity as Medium, while NVD scores the issue at 8.8 due to the potential for arbitrary code execution over the network with user interaction.
Critical Impact
Remote attackers can trigger arbitrary code execution inside the V8 sandbox by luring users to a malicious web page, enabling drive-by compromise of browser sessions.
Affected Products
- Google Chrome versions prior to 152.0.7977.65
- Chromium-based browsers sharing the vulnerable V8 build
- Desktop channels for Windows, macOS, and Linux
Discovery Timeline
- 2026-08-25 - CVE-2026-79097 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79097
Vulnerability Analysis
The vulnerability is a use-after-free condition in V8, the JavaScript and WebAssembly engine that powers Chrome. Use-after-free bugs occur when code continues to reference a memory region after that region has been freed. In V8, such flaws typically arise during garbage collection, inline caching, or optimization passes that hold stale references to JavaScript objects. An attacker who controls script execution in a page can shape the heap, free a target object, and then reintroduce a reference to the dangling memory. This allows the attacker to influence values read or written through the freed object.
Root Cause
The root cause is improper lifetime management of an object handled by the V8 engine. Chrome release notes identify the fix in version 152.0.7977.65 and reference Chromium issue 525689847, which remains restricted pending broad patch deployment. See the Chrome Releases Update for the vendor's advisory.
Attack Vector
Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build. Attackers deliver the page through phishing links, watering-hole compromises, or malvertising. The attacker script triggers the use-after-free, corrupts V8 state, and pivots to arbitrary code execution within the V8 sandbox. A separate sandbox escape would be required to reach the underlying operating system, but renderer-level compromise already exposes cookies, session tokens, and cached credentials for the active origin.
No public proof-of-concept or exploit code is available at this time, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in prose because no verified exploit artifacts have been released.
Detection Methods for CVE-2026-79097
Indicators of Compromise
- Chrome renderer processes crashing with SIGSEGV or EXCEPTION_ACCESS_VIOLATION shortly after visiting an untrusted URL.
- Outbound connections from chrome.exe to unfamiliar domains immediately after a page load event.
- Unexpected child processes spawned by Chrome renderer processes on endpoints running versions earlier than 152.0.7977.65.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any host below 152.0.7977.65.
- Correlate browser crash telemetry with recent navigation history to identify potentially malicious pages.
- Hunt for JavaScript-heavy pages served from newly registered or low-reputation domains that trigger repeated V8 crashes.
Monitoring Recommendations
- Forward Chrome crash reports and endpoint process telemetry into a centralized data lake for correlation.
- Alert on anomalous parent-child relationships originating from chrome.exe, especially spawns of shell or scripting interpreters.
- Track EPSS movement for CVE-2026-79097 (currently 0.303%) and revisit prioritization if exploit availability changes.
How to Mitigate CVE-2026-79097
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Restart Chrome after the update so the patched V8 binary is loaded into every renderer.
- Push equivalent updates to Chromium-based browsers that consume the same V8 branch.
Patch Information
Google addressed the issue in the Stable channel update announced in the Chrome Releases Update. Enterprises managing Chrome through Group Policy or Chrome Browser Cloud Management should enforce the minimum version 152.0.7977.65. Additional context is tracked in Chromium Issue #525689847, which will open publicly after broad deployment.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering while patches propagate.
- Disable JavaScript for high-risk user groups using the DefaultJavaScriptSetting policy where operationally acceptable.
- Enforce Chrome Site Isolation and the V8 sandbox flags to raise the cost of renderer exploitation.
# Configuration example: enforce minimum Chrome version via Group Policy on Windows
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
reg add "HKLM\Software\Policies\Google\Chrome\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
