CVE-2026-79195: Google Chrome Use-After-Free Vulnerability

CVE-2026-79195 Overview

CVE-2026-79195 is a use-after-free vulnerability in the Script component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google's Chromium team rated the security severity as High. The flaw is tracked under CWE-416: Use After Free and requires user interaction to trigger. Successful exploitation compromises confidentiality, integrity, and availability of the browser process, though execution is initially constrained by the Chrome sandbox.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox through a malicious web page, enabling initial access footholds when chained with a sandbox escape.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop Stable channel)
Chromium-based browsers incorporating the vulnerable Script component
Embedded applications using affected Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79195 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79195

Vulnerability Analysis

The vulnerability resides in the Script subsystem of Chrome, which handles JavaScript execution through the V8 engine and its bindings. A use-after-free condition occurs when the browser continues to reference a heap object after it has been freed. Attackers craft HTML and JavaScript that manipulates object lifetime, forcing the renderer to dereference dangling pointers.

Once a freed allocation is reclaimed with attacker-controlled data, the reused pointer can redirect execution flow. This enables arbitrary code execution within the renderer process. The attack complexity is low, and no privileges are required. Exploitation requires user interaction, typically visiting a malicious page or clicking a crafted link.

The issue is tracked in Chromium Issue Tracker #501892500. Google has not disclosed detailed root-cause information while patch adoption progresses.

Root Cause

Use-after-free vulnerabilities in Chrome's Script component typically stem from incorrect reference counting, missing lifetime guards, or reentrancy during garbage collection. When bindings between V8 and Blink release an object while another code path retains a raw pointer, subsequent access reads freed memory. Attackers shape the heap to place controlled data at the freed address, converting the dangling pointer into a type confusion or write primitive.

Attack Vector

Exploitation is remote and occurs through the browser's normal web-loading flow. An attacker hosts a crafted HTML page that delivers JavaScript designed to trigger the specific object-lifetime bug in the Script component. The user must load the page for the exploit to fire. Code execution initially runs inside the renderer sandbox, so attackers commonly pair this bug with a separate sandbox escape to compromise the host.

No verified proof-of-concept code has been published. See the Chromium Issue Tracker for the vendor's technical record.

Detection Methods for CVE-2026-79195

Indicators of Compromise

Renderer process crashes with access-violation signatures on chrome.dll or libv8 modules preceding unexpected child processes
Outbound connections from chrome.exe renderer processes to newly registered or low-reputation domains hosting HTML/JS payloads
Unusual spawning of shell interpreters or rundll32.exe from Chrome browser or helper processes

Detection Strategies

Deploy behavioral endpoint detection that flags child-process creation from browser renderer processes, a common post-exploitation signal after sandbox escape attempts
Enable Chrome enterprise logging and forward chrome://crashes telemetry to centralized logging for correlation of renderer failures across the fleet
Hunt for HTML pages containing large arrays of typed-array allocations or aggressive postMessage/MessageChannel patterns consistent with heap grooming

Monitoring Recommendations

Track Chrome version inventory across managed endpoints and alert when hosts remain below 152.0.7977.65
Monitor DNS and proxy logs for user visits to newly seen domains delivering large obfuscated JavaScript payloads
Correlate crash reports with process-tree telemetry to identify exploitation attempts even when execution fails

How to Mitigate CVE-2026-79195

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after update to ensure the patched binary is loaded, since Chrome only applies updates on relaunch
Audit Chromium-based applications (Edge, Brave, Opera, Electron apps) and apply corresponding vendor updates when available

Patch Information

Google released the fix in the Stable channel update announced at Google Chrome Stable Update. Administrators should confirm deployment via chrome://settings/help or through enterprise management policies. Chromium-based browser vendors typically release their own updates within days of the upstream fix.

Workarounds

Enforce Chrome auto-update policies through the Chrome Enterprise policy templates to remove reliance on user-initiated restarts
Restrict browsing to allowlisted domains for high-value users until patch deployment is verified
Enable Site Isolation and Enhanced Safe Browsing to raise the cost of renderer exploitation while patches roll out

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed version from registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update check via Chrome policy (managed environments)
# Set policy: UpdateDefault=1 and TargetVersionPrefix=152.0.7977.65