CVE-2026-79187: Google Chrome WebRTC Use-After-Free Flaw

CVE-2026-79187 Overview

CVE-2026-79187 is a use-after-free vulnerability in the WebRTC component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can trigger the flaw by convincing a user to load a crafted HTML page. Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox. Google classified the Chromium security severity as High. The weakness maps to CWE-416: Use After Free.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by luring users to a malicious web page, providing a foothold for further sandbox-escape chaining.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Stable channel, Desktop)
Chromium-based browsers that embed the vulnerable WebRTC component
Any application using an unpatched Chromium runtime with WebRTC enabled

Discovery Timeline

2026-08-25 - CVE-2026-79187 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79187

Vulnerability Analysis

The vulnerability resides in Chrome's WebRTC implementation, the subsystem that handles real-time audio, video, and data channel communication in the browser. A use-after-free condition occurs when the renderer continues to reference a WebRTC object after that object's backing memory has been released. An attacker who controls the timing and layout of the freed allocation can reclaim the memory with attacker-influenced data. Dereferencing the stale pointer then leads to arbitrary read, write, or control-flow hijacking within the renderer process.

Exploitation is triggered by a crafted HTML page, meaning no authentication is required and user interaction is limited to visiting a page. Code execution is scoped to the renderer sandbox, so an attacker still needs a separate sandbox escape to achieve full system compromise. Even so, sandboxed code execution enables cross-origin data theft, session hijacking, and staging of secondary exploits.

Root Cause

The root cause is object lifetime mismanagement inside the WebRTC stack, consistent with CWE-416. A reference to a WebRTC-managed object outlives the object itself, typically because a callback, event handler, or task continues to hold a raw pointer after destruction. Full technical detail is restricted in the Chromium Issue Tracker #523296105 pending broad patch adoption.

Attack Vector

The attack is network-delivered. An adversary hosts a malicious HTML page that instantiates and manipulates WebRTC objects (for example, RTCPeerConnection, data channels, or media tracks) in a sequence that forces the vulnerable free-then-use pattern. The victim only needs to load the page in an unpatched Chrome build for the renderer to enter the exploitable state. See the Google Chrome Stable Update advisory for the vendor bulletin.

No public proof-of-concept or exploit code is available at the time of publication. See the Chromium Issue Tracker #523296105 for future technical disclosure.

Detection Methods for CVE-2026-79187

Indicators of Compromise

Chrome renderer processes crashing with access violation or heap corruption signatures shortly after visiting an unfamiliar site.
Unexpected outbound WebRTC signaling or STUN/TURN traffic from user endpoints to non-corporate infrastructure.
Browser telemetry showing installed Chrome versions below 152.0.7977.65 still active in the environment.

Detection Strategies

Inventory Chrome and Chromium-based browser versions across managed endpoints and flag any build earlier than 152.0.7977.65.
Alert on renderer process crashes correlated with browsing sessions, especially those involving WebRTC APIs.
Correlate web proxy logs with threat intelligence to identify visits to domains hosting known WebRTC exploit kits.

Monitoring Recommendations

Ingest endpoint browser telemetry and process crash events into your SIEM for continuous version and stability monitoring.
Monitor for child process spawns from chrome.exe renderer processes that deviate from baseline behavior.
Track outbound connections initiated by renderer processes to detect post-exploitation command-and-control staging.

How to Mitigate CVE-2026-79187

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Force-restart the browser after update deployment to ensure the patched binaries are loaded.
Audit Chromium-based applications (Edge, Brave, Opera, Electron apps) and apply vendor updates that incorporate the fixed WebRTC code.

Patch Information

Google addressed CVE-2026-79187 in the Chrome Stable channel release 152.0.7977.65. Details are available in the Google Chrome Stable Update advisory. Downstream Chromium projects should pull the corresponding upstream commit referenced in Chromium Issue Tracker #523296105.

Workarounds

Enforce Chrome auto-update policies through group policy or MDM to prevent version drift.
Restrict access to untrusted sites via web filtering until patch rollout is verified across the fleet.
Where WebRTC is not required, disable it through enterprise policy or extension controls to reduce attack surface.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Minimum required patched version
# 152.0.7977.65