CVE-2026-79128: Google Chrome Use After Free Vulnerability

CVE-2026-79128 Overview

CVE-2026-79128 is a use-after-free vulnerability in the Views component of Google Chrome on macOS. The flaw affects versions prior to 152.0.7977.65 and allows a remote attacker to execute arbitrary code outside the Chrome sandbox through a crafted HTML page. Chromium developers rated the security severity as Medium, but the National Vulnerability Database scoring reflects a higher impact due to sandbox escape potential. The vulnerability is tracked under CWE-416: Use After Free.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome renderer sandbox on macOS hosts, bypassing a core browser isolation boundary.

Affected Products

Google Chrome for macOS versions prior to 152.0.7977.65
Apple macOS (host operating system running the vulnerable Chrome build)
Chromium-derived browsers on macOS that inherit the vulnerable Views code

Discovery Timeline

2026-08-25 - CVE-2026-79128 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database
2026-08-25 - Google publishes the Stable Channel Update for Desktop containing the fix

Technical Details for CVE-2026-79128

Vulnerability Analysis

The vulnerability resides in the Views subsystem, the cross-platform UI framework used by Chrome to render browser chrome components such as menus, dialogs, and toolbars. A use-after-free condition occurs when Views code retains a pointer to an object after that object's memory has been released. Subsequent access to the freed memory allows an attacker to influence control flow.

Because Views executes in the browser process rather than the sandboxed renderer, an attacker who triggers the freed-object reuse gains code execution privileges outside the renderer sandbox. This bypasses the primary isolation boundary Chrome relies on to contain malicious web content. The crafted HTML page triggers the vulnerable code path through user interaction with a web page that manipulates UI elements exposed by Views.

Root Cause

The root cause is improper object lifetime management in the Views component. A reference to a Views object persists after the object is destroyed, and later access dereferences the dangling pointer. An attacker can spray the heap between the free and the reuse to place attacker-controlled data at the address referenced by the stale pointer, enabling arbitrary code execution.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build on macOS. User interaction is required, consistent with the CVSS metric indicating attacker-supplied content must be rendered and engaged with. No authentication is needed. Because the affected code runs in the browser process, successful exploitation yields code execution outside the renderer sandbox.

No verified public proof-of-concept code is available. For technical details, refer to the Chromium Issue Tracker #502109333.

Detection Methods for CVE-2026-79128

Indicators of Compromise

Chrome browser process (Google Chrome) spawning unexpected child processes such as shells or scripting interpreters on macOS
Unexpected outbound network connections initiated by the Chrome browser process to non-Google infrastructure
Crash reports referencing the Views subsystem preceding suspicious process activity
macOS unified log entries showing Chrome accessing files or system APIs unrelated to normal browsing

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build older than 152.0.7977.65
Correlate Chrome browser process behavior with post-exploitation activity such as persistence creation under ~/Library/LaunchAgents
Baseline normal Chrome child-process patterns and alert on deviations that indicate sandbox escape

Monitoring Recommendations

Monitor Chrome process lineage on macOS for anomalous descendants such as bash, zsh, osascript, or curl
Track file writes by Chrome to non-standard locations outside its profile directory
Ingest EDR telemetry into a centralized data lake to enable retroactive hunting for pre-patch exploitation attempts

How to Mitigate CVE-2026-79128

Immediate Actions Required

Update Google Chrome on macOS to version 152.0.7977.65 or later across all managed endpoints
Force-restart Chrome after the update so the patched binary is loaded into memory
Audit Chromium-based browsers deployed in the environment and confirm they have absorbed the upstream fix

Patch Information

Google addressed the vulnerability in the Chrome stable channel release documented in the Stable Channel Update for Desktop. macOS users should upgrade to 152.0.7977.65 or later. Enterprise administrators can enforce the update through mobile device management policies or the Chrome Enterprise update controls.

Workarounds

No vendor-supplied workaround exists; applying the patched Chrome build is the only supported remediation
Restrict browsing to trusted sites on unpatched hosts until the update is deployed
Consider temporarily blocking unmanaged Chrome installations on macOS endpoints through application control policies

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Trigger managed update via Google Software Update (if enrolled)
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent --install