CVE-2026-79155: Google Chrome Race Condition Vulnerability

CVE-2026-79155 Overview

CVE-2026-79155 is a race condition vulnerability in the FileSystem component of Google Chrome prior to version 152.0.7977.65. A remote attacker who has already compromised the renderer process can exploit this flaw to execute arbitrary code outside the Chrome sandbox. Exploitation requires a crafted HTML page and user interaction. Chromium classifies the security severity as High. The weakness is categorized as CWE-367: Time-of-Check Time-of-Use (TOCTOU). Successful exploitation breaks the browser's core sandbox boundary, enabling code execution in a higher-privileged process context on the host system.

Critical Impact
A sandbox escape from the Chrome renderer to code execution outside the sandbox, when chained with a prior renderer compromise from a malicious web page.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable FileSystem code
Applications built on the affected Chromium release stream

Discovery Timeline

2026-08-25 - CVE-2026-79155 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD
2026-08 - Google publishes the Stable Channel Update for Desktop containing the fix

Technical Details for CVE-2026-79155

Vulnerability Analysis

The flaw resides in Chrome's FileSystem implementation, which brokers file operations between the sandboxed renderer process and the more privileged browser process. A race condition allows an attacker who controls the renderer to manipulate state between the time a file operation is validated and the time it is actually performed. This TOCTOU pattern enables the renderer to influence privileged operations in a way the security checks did not anticipate. The result is arbitrary code execution outside the renderer sandbox, effectively achieving a sandbox escape. Sandbox escapes are typically chained with a separate renderer bug to reach a fully compromised host.

Root Cause

The root cause is a Time-of-Check Time-of-Use (CWE-367) condition in the FileSystem component. Security checks and the subsequent file operations do not execute atomically. A concurrent thread controlled or influenced by the compromised renderer can alter the referenced object between check and use. Details are tracked in Chromium Issue Tracker #522294538, which remains access-restricted pending broader patch adoption.

Attack Vector

Exploitation requires an already-compromised renderer process, typically obtained through a prior memory corruption bug triggered by a crafted HTML page. The attacker delivers the crafted page over the network and induces user interaction, such as loading the site. From the renderer, the attacker issues concurrent FileSystem requests designed to win the race window. Winning the race allows privileged file operations that the renderer should not be able to perform, leading to code execution outside the sandbox. See the Chromium security advisory for context.

Detection Methods for CVE-2026-79155

Indicators of Compromise

Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or sh shortly after browsing activity
Unexpected file writes or renames performed under user profile paths correlated with Chrome renderer activity
Crash reports in Chrome referencing the FileSystem component or renderer-to-browser IPC anomalies
Outbound connections from Chrome-spawned processes to unfamiliar external hosts after visiting untrusted sites

Detection Strategies

Inventory endpoints running Chrome versions below 152.0.7977.65 and prioritize them for patch verification
Alert on child processes of chrome.exe outside the expected Chromium process tree, especially interpreters and script hosts
Monitor for anomalous file system activity originating from Chrome sandbox helper processes
Correlate browser exploitation indicators with subsequent persistence attempts, such as scheduled task or registry Run key writes

Monitoring Recommendations

Ingest browser telemetry, process lineage, and file system events into a centralized data lake for cross-source correlation
Track Chrome version drift across managed endpoints and flag hosts not on the fixed build within defined SLAs
Baseline normal Chrome IPC and child-process behavior to surface deviations tied to sandbox escape attempts

How to Mitigate CVE-2026-79155

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after update to ensure the patched binary is active; pending updates do not apply until relaunch
Verify Chromium-based browsers and embedded frameworks have absorbed the corresponding upstream fix
Prioritize systems with high user privilege or access to sensitive data during patch rollout

Patch Information

Google addressed CVE-2026-79155 in the Stable Channel release 152.0.7977.65 for Desktop. Details are documented in the Google Chrome Stable Channel Update. Enterprises using managed Chrome deployments should push the update via existing configuration channels and confirm the effective version on endpoints. Chromium downstream vendors should track upstream integration of the fix and issue matching updates.

Workarounds

No vendor-supplied workaround exists; apply the patch as the definitive mitigation
Restrict browsing to trusted sites via enterprise policy until patching is complete
Enforce site isolation and standard user accounts to reduce post-exploit impact
Disable or restrict experimental FileSystem and file access web platform features via Chrome Enterprise policies where feasible

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enforce minimum version via Chrome Enterprise policy (example: macOS plist)
defaults write com.google.Chrome TargetVersionPrefix -string "152.0.7977.65"