CVE-2026-79175: Google Chrome Windows RCE Vulnerability

CVE-2026-79175 Overview

CVE-2026-79175 is a type confusion vulnerability [CWE-843] in the Accessibility component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the Chrome sandbox using a crafted HTML page. Google's Chromium security team rated the underlying issue as High severity. Exploitation requires user interaction, such as visiting an attacker-controlled page, and depends on a prior renderer compromise.

Critical Impact
Successful exploitation enables sandbox escape and arbitrary code execution on the host, giving attackers a foothold outside the browser's isolation boundary.

Affected Products

Google Chrome for Windows prior to 152.0.7977.65
Chromium-based builds on Windows sharing the vulnerable Accessibility code
Downstream browsers embedding the affected Chromium branch

Discovery Timeline

2026-08-25 - CVE-2026-79175 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79175

Vulnerability Analysis

The vulnerability resides in Chrome's Accessibility subsystem, which exposes the browser's document object model to assistive technologies. Type confusion [CWE-843] occurs when code interprets an object as a different type than it actually is. In this case, the Accessibility component mishandles object typing during interactions triggered by a crafted HTML page. The resulting mismatch lets attackers manipulate memory in a way that yields code execution outside the renderer sandbox.

Because the Accessibility service runs at a higher privilege boundary than the renderer, a bug in this interface is a common target for sandbox escapes. The attack chain typically pairs this issue with a separate renderer exploit to reach browser-process code execution.

Root Cause

The defect is a type confusion in the Accessibility implementation on Windows. Chromium code consumes an object reference of one type while the underlying object is of a different, incompatible type. This mismatch corrupts state or bypasses safety checks, providing an exploitation primitive to an attacker who already controls the renderer process.

Attack Vector

Exploitation is network-based and requires user interaction to load a crafted HTML page. Attack complexity is high, and the scope changes because a successful exploit crosses the sandbox trust boundary. The attacker must first compromise the Chrome renderer process, then trigger the Accessibility path to escape the sandbox. See the Google Chrome Stable Update and Chromium Issue Tracker #498885920 for further detail.

Detection Methods for CVE-2026-79175

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe from a renderer or utility process context.
Crashes in chrome.exe referencing Accessibility (content_accessibility or ui_accessibility) modules on Windows hosts.
Outbound connections from Chrome to previously unseen domains immediately following a page navigation event.

Detection Strategies

Correlate browser process telemetry with process-tree anomalies where Chrome creates non-browser child processes.
Alert on Chrome renderer or GPU crashes coinciding with navigation to newly registered or low-reputation domains.
Monitor for on-disk writes by Chrome processes into user-writable auto-run locations, which suggests post-exploit persistence.

Monitoring Recommendations

Ingest Windows Sysmon process creation and image load events for chrome.exe and its child processes.
Track Chrome version inventory across managed endpoints and flag hosts still running builds prior to 152.0.7977.65.
Review WER (Windows Error Reporting) telemetry for repeated Chrome faults with Accessibility-related stack frames.

How to Mitigate CVE-2026-79175

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later on all managed and unmanaged endpoints.
Restart Chrome after updating to ensure the patched binaries are loaded into active sessions.
Audit third-party Chromium-based browsers and force updates once vendors ship the corresponding fix.

Patch Information

Google addressed CVE-2026-79175 in the Chrome Stable channel at version 152.0.7977.65 for Windows. Refer to the Google Chrome Stable Update announcement and the Chromium Issue Tracker #498885920 for release details.

Workarounds

Enforce automatic Chrome updates through enterprise policy to reduce exposure windows.
Restrict browsing to trusted sites via web filtering or DNS controls until patch deployment completes.
Apply application allowlisting to prevent Chrome child processes from launching interpreters or scripting hosts.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce minimum version via Chrome Enterprise policy (registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f