CVE-2026-79183 Overview
CVE-2026-79183 is a use-after-free vulnerability in the Accessibility component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to trigger the flaw through UI interaction, leading to arbitrary code execution outside the Chrome sandbox. Google's Chromium team rated the security severity as High. The weakness is tracked under CWE-416 and requires the victim to interact with attacker-controlled content in the browser.
Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome renderer sandbox on the victim's system.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.65
- Chromium-based browsers incorporating the vulnerable Accessibility component
- Downstream distributions bundling pre-patch Chromium builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79183 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79183
Vulnerability Analysis
The vulnerability resides in Chrome's Accessibility subsystem, which exposes the accessibility tree to assistive technologies and automation clients. A use-after-free condition occurs when code retains a pointer to an accessibility object after that object's backing memory has been released. Subsequent operations on the dangling pointer allow an attacker to manipulate freed memory that has been reallocated with controlled data.
An attacker who convinces a user to interact with a crafted page can drive the Accessibility component into the vulnerable code path. The resulting memory corruption escapes the renderer sandbox, giving the attacker code execution in a higher-privileged Chrome process. Chromium classifies the issue as High severity because it combines sandbox escape with remote reachability through a standard browsing session.
Root Cause
The root cause is object lifetime mismanagement inside the Accessibility component, classified as CWE-416: Use After Free. An accessibility object is freed while another code path still holds a reference. When the stale reference is later dereferenced during UI interaction, the process operates on memory an attacker can control.
Attack Vector
Exploitation is network-reachable and requires user interaction. The attacker delivers a malicious page or resource, then uses social engineering to induce the specific UI interaction that triggers the vulnerable Accessibility code path. No authentication is required, and the attack scope changes because the sandbox boundary is crossed.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been documented in the referenced sources. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor details.
Detection Methods for CVE-2026-79183
Indicators of Compromise
- Chrome renderer or utility processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS and Linux
- Chrome browser processes writing executables or scripts to user-writable directories shortly after visiting an unfamiliar site
- Outbound network connections from Chrome child processes to previously unseen infrastructure following a social-engineering lure
Detection Strategies
- Alert on anomalous process ancestry where chrome.exe or its helper processes launch scripting or LOLBins outside expected update flows
- Correlate browser crash telemetry referencing accessibility modules with subsequent process creation or persistence activity
- Monitor endpoints for outdated Chrome installations reporting a version earlier than 152.0.7977.65
Monitoring Recommendations
- Track Chrome version inventory across managed endpoints and flag hosts running versions below 152.0.7977.65
- Ingest browser process, file, and network telemetry into a centralized data lake to enable retroactive hunting once new indicators emerge
- Review escalations involving accessibility APIs, especially on hosts where assistive technologies are not normally in use
How to Mitigate CVE-2026-79183
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Restart Chrome after applying the update to ensure the patched binaries are loaded
- Audit Chromium-based browsers and embedded WebViews in the environment and apply corresponding vendor updates
Patch Information
Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Patch details are published in the Google Chrome Update Announcement, with issue tracking in the Chromium Issue Tracker Entry. Administrators should push the update through enterprise management tooling and verify version compliance across the fleet.
Workarounds
- No vendor-supplied workaround exists; patching is the supported remediation
- Reduce exposure by restricting browsing to trusted sites and enforcing user awareness training against social-engineering lures
- Where feasible, enable enterprise policies that automate Chrome updates and block execution of unsigned binaries dropped by browser processes
# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Enforce auto-update policy (Windows, per Google ADMX template)
# Set: Computer Configuration > Policies > Google > Google Update > Applications > Google Chrome
# Update policy override = Always allow updates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
