CVE-2026-79197: Google Chrome V8 Use After Free Vulnerability

CVE-2026-79197 Overview

CVE-2026-79197 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The vulnerability is categorized under CWE-416: Use After Free and requires user interaction to trigger. Google's Chromium security team assigned this issue a severity of Low, though the NVD scoring reflects a higher impact due to the arbitrary code execution outcome.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome sandbox through a malicious webpage, providing a foothold for further exploitation when chained with a sandbox escape.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable V8 builds
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79197 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79197

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when the engine references memory that has already been freed. Attackers who control the timing and content of allocations can reclaim the freed memory with attacker-shaped data. This primitive typically enables type confusion or corrupted object metadata, which V8 then dereferences during script execution. The result is arbitrary code execution constrained to the renderer process sandbox.

Root Cause

The root cause is improper object lifetime management in V8 [CWE-416]. Code paths retain a raw pointer or handle to a JavaScript object after the garbage collector or explicit deallocation frees the backing memory. Subsequent operations dereference the stale reference during optimized code paths, JIT compilation, or built-in function execution. Refer to Chromium Issue #531297707 for the upstream tracking record.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers JavaScript that manipulates V8 objects to reach the vulnerable code path and reclaim the freed allocation. Successful exploitation yields code execution inside the renderer sandbox. A separate sandbox escape is required to reach the host operating system. No authentication is required, and the attack executes over the network via standard web content.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. See the Google Chrome Stable Update advisory for release details.

Detection Methods for CVE-2026-79197

Indicators of Compromise

Chrome renderer processes crashing with access violations or heap corruption signatures shortly after visiting untrusted pages
Unexpected child processes spawned by chrome.exe following browsing sessions
Outbound connections from renderer processes to previously unseen domains hosting heavy JavaScript payloads
Browser telemetry showing V8 optimizer or garbage collector faults on specific URLs

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Correlate web proxy logs with endpoint browser crash telemetry to identify pages triggering renderer failures
Monitor for post-exploitation behaviors such as renderer processes writing executables or invoking PowerShell, cmd.exe, or bash
Apply behavioral rules that identify anomalous process trees originating from browser processes

Monitoring Recommendations

Ingest browser crash reports and EDR process telemetry into a central data lake for correlation
Alert on Chrome minor-version drift within enterprise fleets
Track threat intelligence feeds for public exploits referencing V8 use-after-free issues

How to Mitigate CVE-2026-79197

Immediate Actions Required

Update Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after patching to ensure the vulnerable renderer binaries are unloaded
Verify Chromium-based browsers and embedded WebViews for updated V8 builds
Restrict browsing to trusted destinations on any systems that cannot be patched immediately

Patch Information

Google released the fix in the Chrome Stable channel build 152.0.7977.65. Details are available in the Google Chrome Stable Update release notes. Enterprise administrators should force Chrome auto-update policies to apply the patch across all endpoints without user intervention.

Workarounds

Enable Chrome's Site Isolation to constrain renderer compromise to a single origin
Deploy browser policies that disable JavaScript on high-risk or unclassified sites where feasible
Use network filtering to block access to known malicious HTML delivery infrastructure
Configure endpoint controls to prevent browser processes from launching script interpreters and shells

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version