CVE-2026-79132: Google Chrome Android RCE Vulnerability

CVE-2026-79132 Overview

CVE-2026-79132 is an improper input validation vulnerability in the Input component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the Chrome sandbox using a crafted HTML page. The Chromium project classifies the underlying weakness as CWE-20: Improper Input Validation. Google rated the Chromium security severity as Medium, while NVD scored it 8.3 (High) due to the scope-changing sandbox escape impact.

Critical Impact
Successful exploitation allows arbitrary code execution outside the renderer sandbox on Android devices, breaking a core Chrome security boundary and exposing user data and device functionality.

Affected Products

Google Chrome on Android prior to 152.0.7977.65
Google Android (host operating system for the affected Chrome build)
Chromium-based mobile builds sharing the vulnerable Input component

Discovery Timeline

2026-08-25 - CVE-2026-79132 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79132

Vulnerability Analysis

The vulnerability resides in the Input handling logic of Chrome on Android. Chrome enforces a multi-process architecture where renderer processes are isolated from privileged browser processes by a sandbox. This bug allows crafted input data crossing the renderer-to-browser interface to bypass validation. An attacker who already controls the renderer can leverage the flaw to reach code paths that execute with browser-process privileges. The result is a sandbox escape, one of the highest-value primitives in browser exploitation chains. NVD's CVSS assessment reflects the scope change from renderer to browser process, which is why the score exceeds Chromium's own Medium rating.

Root Cause

The root cause is classified under CWE-20: Improper Input Validation. The Input component fails to properly validate data received from a lower-privileged renderer before acting on it in a higher-privileged context. Google has not publicly released implementation-level details. See the Chromium Issue Tracker #513834155 for restricted technical information.

Attack Vector

Exploitation requires two stages. First, the attacker must compromise the Chrome renderer process, typically through a separate vulnerability such as a memory corruption bug reached via a crafted HTML page. Second, the attacker uses CVE-2026-79132 to escape the sandbox. User interaction is required, since the victim must load attacker-controlled web content in Chrome for Android. No verified proof-of-concept code has been published.

No verified exploit code is publicly available for CVE-2026-79132.
Refer to the Chromium Issue Tracker #513834155 for restricted details.

Detection Methods for CVE-2026-79132

Indicators of Compromise

Unexpected child processes spawned by Chrome on Android outside normal renderer lifecycle patterns.
Chrome application crashes or renderer terminations correlated with visits to untrusted web content.
Outbound network connections from the Chrome browser process to unfamiliar hosts shortly after page loads.

Detection Strategies

Monitor mobile endpoints for outdated Chrome versions below 152.0.7977.65 using device management telemetry.
Correlate browser crash reports with recently visited URLs to identify potential exploitation attempts against the Input component.
Alert on anomalous privilege transitions or IPC message patterns between Chrome renderer and browser processes where telemetry is available.

Monitoring Recommendations

Enforce mobile threat defense policies that flag devices running Chrome versions prior to 152.0.7977.65.
Ingest Chrome update posture and crash telemetry into a centralized SIEM for cross-device correlation.
Track access to untrusted web content on managed Android devices, particularly in high-risk user populations.

How to Mitigate CVE-2026-79132

Immediate Actions Required

Update Chrome on all Android devices to version 152.0.7977.65 or later through the Google Play Store.
Verify enterprise mobile device management (MDM) policies enforce automatic Chrome updates.
Audit fleet-wide Chrome version inventory and remediate any devices still on vulnerable builds.

Patch Information

Google released the fix in the Stable channel update announced in the Chrome Releases blog. Users should install Chrome for Android version 152.0.7977.65 or later. The corresponding upstream fix is tracked in Chromium Issue #513834155.

Workarounds

Restrict browsing to trusted sites on unpatched Android devices until the update is applied.
Use MDM configuration to temporarily block Chrome launches on non-compliant devices where feasible.
Deploy mobile threat defense controls that block known malicious URLs and exploit delivery infrastructure.

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 152.0.7977.65 or later