CVE-2026-79140: Google Chrome Use After Free Vulnerability

CVE-2026-79140 Overview

CVE-2026-79140 is a use-after-free vulnerability in the Views component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to load a crafted HTML page. The vulnerability is tracked as [CWE-416: Use After Free].

Google rates the Chromium security severity as Medium, but the NVD CVSS 3.1 assessment scores it 9.6 due to sandbox escape potential and changed scope. Successful exploitation grants code execution in the browser process context on macOS hosts.

Critical Impact
A single visit to a malicious HTML page can trigger arbitrary code execution outside the Chrome sandbox on macOS, bypassing a primary browser security boundary.

Affected Products

Google Chrome for macOS prior to 152.0.7977.65
Apple macOS (all supported versions running vulnerable Chrome builds)
Chromium-based builds sharing the Views implementation on macOS

Discovery Timeline

2026-08-25 - CVE-2026-79140 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79140

Vulnerability Analysis

The vulnerability resides in the Views UI framework, the Chromium subsystem responsible for rendering browser chrome, dialogs, and native window elements on desktop platforms. A use-after-free condition occurs when code references a Views object after its backing memory has been released. On macOS, attacker-controlled content in a crafted HTML page triggers the dangling reference during UI event handling.

Because Views runs in the privileged browser process rather than the sandboxed renderer, successful memory corruption yields execution outside the renderer sandbox. This bypasses the process isolation model that normally contains web content.

Root Cause

The root cause is object lifetime mismanagement in the Views component. A pointer or reference to a Views object continues to be used after the object is destroyed. When the attacker reclaims the freed memory with a controlled allocation, subsequent method dispatch or virtual table lookups execute attacker-influenced code paths. See Chromium Issue Tracker #502101200 for the tracked defect.

Attack Vector

Exploitation requires a user to navigate to a malicious webpage or a compromised site hosting attacker-controlled HTML. The attacker crafts DOM structures and JavaScript that induce the specific Views object teardown and reuse sequence. No authentication is required. Because the flaw allows sandbox escape, chaining with a renderer-side exploit is not necessary for privileged code execution.

No public proof-of-concept exploit is available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79140

Indicators of Compromise

Chrome browser process (Google Chrome) spawning unexpected child processes such as bash, osascript, or curl following web navigation
Unusual outbound network connections initiated by the Chrome main process rather than helper renderer processes
Crash dumps referencing the Views subsystem or heap-use-after-free signatures in Chrome on macOS endpoints
New persistence artifacts under ~/Library/LaunchAgents/ created shortly after browser activity

Detection Strategies

Inventory Chrome versions across macOS endpoints and flag any host running a build older than 152.0.7977.65
Alert on process lineage where the Chrome browser process (not a renderer helper) launches shell interpreters or scripting engines
Monitor macOS EndpointSecurity events for anomalous file writes and code signing anomalies originating from Chrome

Monitoring Recommendations

Ingest browser telemetry and macOS Unified Log data into a centralized analytics platform for cross-host correlation
Track outbound DNS and TLS SNI from Chrome processes to identify connections to newly registered or low-reputation domains
Correlate email and web proxy logs with endpoint navigation events to detect delivery of crafted HTML lures

How to Mitigate CVE-2026-79140

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later
Force-restart Chrome after deploying the update, as running instances retain the vulnerable code in memory
Audit managed device fleets through MDM to confirm the patched version is installed
Restrict browsing to known-good destinations for users on hosts that cannot be updated immediately

Patch Information

Google addressed this vulnerability in the Stable Channel update covered by the Google Chrome Security Update advisory. Users should upgrade to Chrome 152.0.7977.65 or newer for macOS. Enterprise deployments using Chrome Browser Cloud Management or MDM profiles should push the update immediately.

Workarounds

No official workaround exists; patching is the only complete remediation
Enforce Chrome auto-update policies through macOS configuration profiles to reduce exposure windows
Deploy web filtering to block access to untrusted or newly registered domains until the patch is applied
Reduce local user privileges so post-exploitation impact is limited if the sandbox escape succeeds

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check via defaults (managed environments)
defaults write com.google.Keystone.Agent checkInterval 3600

# MDM: enforce minimum Chrome version policy key
# Key: MinimumAllowedVersion
# Value: 152.0.7977.65