CVE-2026-79150: Google Chrome Use After Free Vulnerability

CVE-2026-79150 Overview

CVE-2026-79150 is a use-after-free vulnerability in the Views component of Google Chrome on macOS. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the target user to visit a crafted HTML page. Google's Chromium security team rated the underlying issue as Critical severity. The bug is tracked under CWE-416: Use After Free and referenced in Chromium Issue Tracker #518006007.

Critical Impact
Remote attackers can escape the Chrome sandbox and execute arbitrary code on macOS endpoints after a single visit to a malicious page.

Affected Products

Google Chrome for macOS prior to 152.0.7977.65
Apple macOS (host operating system for affected Chrome installations)
Chromium-based downstream browsers that ship the vulnerable Views code on macOS

Discovery Timeline

2026-08-25 - CVE-2026-79150 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79150

Vulnerability Analysis

The vulnerability resides in Chrome's Views framework, the cross-platform UI toolkit that renders browser chrome elements such as menus, dialogs, and tab strips. A use-after-free condition occurs when code retains a pointer to a Views object after that object's memory has been released. Subsequent access to the dangling pointer produces undefined behavior that an attacker can steer toward controlled memory.

On macOS, successful exploitation results in arbitrary code execution outside the renderer sandbox. This distinguishes the flaw from typical renderer-only bugs and places it in the sandbox-escape category. User interaction is required, since the victim must load attacker-controlled HTML in the browser.

Root Cause

The defect is a lifetime management error in the Views component [CWE-416]. An object is freed while a reference to it remains reachable through UI event handling or animation callbacks. When the freed memory is reused for attacker-influenced data, method dispatch on the stale pointer transfers control flow to attacker-chosen code.

Attack Vector

An attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised site. The page triggers the object lifecycle sequence that produces the dangling pointer. After heap grooming, the attacker gains code execution in the browser process on macOS, bypassing the renderer sandbox boundary.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker #518006007 for restricted technical detail as it becomes public.

Detection Methods for CVE-2026-79150

Indicators of Compromise

Chrome browser processes on macOS spawning unexpected child processes such as bash, osascript, curl, or python
Chrome writing executable files to user-writable paths outside the standard cache and profile directories
Outbound connections from Chrome helper processes to newly registered or low-reputation domains immediately after page loads
Crash reports referencing the Views component with heap corruption or invalid pointer signatures on Chrome versions below 152.0.7977.65

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build earlier than 152.0.7977.65
Alert on anomalous parent-child process relationships originating from Google Chrome Helper on macOS
Correlate browser crash telemetry with subsequent process creation or persistence events on the same host
Monitor for unsigned or newly created binaries executed by Chrome helper processes

Monitoring Recommendations

Ingest macOS Endpoint Security telemetry (process, file, and network events) into a centralized detection pipeline
Track Chrome update compliance as a continuous control rather than a one-time patch cycle
Baseline normal Chrome network egress and alert on deviations following user navigation events

How to Mitigate CVE-2026-79150

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Verify managed browser policies enforce automatic updates and prohibit users from postponing them
Communicate phishing awareness guidance while patch deployment is in progress

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm the installed build reports as 152.0.7977.65 or higher via chrome://settings/help. Chromium-based browsers on macOS should apply their vendor's corresponding update once merged from upstream.

Workarounds

No vendor-provided workaround exists; upgrading to the patched Chrome build is the only supported remediation
Restrict browsing to trusted sites through enterprise web filtering until patching is complete
Deploy application allowlisting on macOS to limit which binaries Chrome helper processes can execute

bash

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check via managed preferences (example)
defaults write com.google.Keystone.Agent checkInterval 3600