CVE-2026-79129: Google Chrome Use After Free Vulnerability

CVE-2026-79129 Overview

CVE-2026-79129 is a use-after-free vulnerability in the Sessions component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering and UI interaction to trigger memory corruption. Successful exploitation allows arbitrary code execution outside the browser sandbox. The weakness is classified under CWE-416: Use After Free.

Critical Impact
Remote attackers can escape the Chrome sandbox on Android devices and execute arbitrary code after tricking a user into interacting with a crafted page.

Affected Products

Google Chrome for Android versions prior to 152.0.7977.65
Google Android devices running vulnerable Chrome builds
Chromium-based components relying on the Sessions module

Discovery Timeline

2026-08-25 - CVE-2026-79129 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79129

Vulnerability Analysis

The vulnerability resides in the Sessions component of Chrome on Android. Sessions manages tab state, restoration, and navigation history across the browser lifecycle. A use-after-free condition occurs when the component references heap memory that has already been released. An attacker who controls the reclaimed allocation can influence execution flow inside the browser process. Because the flaw can be reached from the renderer boundary and abused with user interaction, successful chaining permits code execution outside the sandbox. This elevates impact well beyond a typical renderer compromise.

Root Cause

The root cause is improper object lifetime management in the Sessions subsystem. Chrome frees a Sessions-related object while another code path retains a dangling reference. Subsequent access to the freed object dereferences attacker-influenceable memory. This class of bug (CWE-416) frequently enables arbitrary read, write, or control-flow hijacking primitives in Chromium.

Attack Vector

Exploitation requires the victim to visit a malicious or compromised page and perform a specific UI interaction. The attacker delivers a crafted page that manipulates session state to trigger the freed-object reuse. Combined with a sandbox escape primitive, the chain executes code with browser process privileges on the Android device. No authentication is required. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor context. Note: no public proof-of-concept or exploit code is available at time of publication.

Detection Methods for CVE-2026-79129

Indicators of Compromise

Chrome for Android processes crashing with SIGSEGV or heap corruption signatures shortly after visiting an unfamiliar site
Unexpected child process spawns or native library loads originating from com.android.chrome
Outbound connections from mobile endpoints to newly registered or low-reputation domains following browser interaction

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag builds older than 152.0.7977.65
Correlate mobile telemetry with web proxy logs to identify users visiting suspicious URLs that precede browser crashes
Monitor Android crash reports for repeated faults in Chrome's Sessions or tab restore code paths

Monitoring Recommendations

Ingest MDM and mobile threat defense logs into a centralized data lake to track Chrome version drift
Alert on anomalous post-browser process behavior such as file writes to app data directories or accessibility service abuse
Track threat intelligence feeds for emerging exploit chains targeting Chromium on Android

How to Mitigate CVE-2026-79129

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
Push mandatory Chrome updates via enterprise mobility management for all managed Android devices
Educate users on the social engineering component: avoid unsolicited links and UI prompts from untrusted sites

Patch Information

Google addressed the flaw in Chrome 152.0.7977.65. Review the Google Chrome Update Announcement for the full release notes and the Chromium Issue Tracker Entry for upstream context. Apply the update on every Android device that runs Chrome as the primary or embedded browser.

Workarounds

Restrict browsing to trusted sites on unpatched devices until updates are deployed
Use enterprise policy to enforce Chrome auto-update on Android and block installation of outdated APKs
Disable or limit session restore features where feasible via managed configuration

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Force update through Play Store
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.android.chrome"