CVE-2026-79198: Google Chrome Use-After-Free Vulnerability

CVE-2026-79198 Overview

CVE-2026-79198 is a use-after-free vulnerability in the Platform component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the flaw by serving a crafted HTML page, triggering memory corruption that leads to arbitrary code execution within the Chrome sandbox. The issue is tracked under CWE-416: Use After Free and Chromium classifies its security severity as High. Exploitation requires user interaction, typically visiting an attacker-controlled web page.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Platform component
All supported desktop operating systems (Windows, macOS, Linux) running the affected Chrome versions

Discovery Timeline

2026-08-25 - CVE-2026-79198 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79198

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition in the Chrome Platform component. Use-after-free flaws occur when a program continues to reference memory after it has been released, allowing an attacker to influence the contents of that reclaimed memory. In Chrome, this class of bug frequently permits attackers to hijack control flow through corrupted object pointers or vtables.

An attacker delivers a crafted HTML page that triggers the specific sequence of object allocation, release, and reuse required to exercise the flaw. Successful exploitation results in arbitrary code execution within the renderer sandbox. While the sandbox constrains immediate impact, UAF primitives in Chrome are routinely chained with sandbox escapes to achieve full system compromise.

Root Cause

The root cause is improper lifetime management of an object within Chrome's Platform component. A reference to freed memory is retained and later dereferenced, giving an attacker control over the memory contents at dereference time. Detailed root-cause analysis is tracked in Chromium Issue #536606137.

Attack Vector

The attack vector is remote and network-based. The victim must load an attacker-controlled or compromised web page in a vulnerable Chrome build. No credentials are required. Common delivery mechanisms include phishing links, malicious advertisements, and watering-hole compromises of legitimate sites.

No public proof-of-concept or exploit is currently available. See the Google Chrome Desktop Update announcement for the vendor's disclosure.

Detection Methods for CVE-2026-79198

Indicators of Compromise

Chrome renderer processes crashing with access-violation or segmentation-fault signatures shortly after loading an untrusted page
Unexpected child processes spawned by chrome.exe or the renderer helper on macOS/Linux following browsing activity
Outbound network connections from Chrome renderer processes to unfamiliar domains hosting heavy JavaScript payloads

Detection Strategies

Inventory Chrome installations and flag any endpoint running a version below 152.0.7977.65
Correlate browser crash telemetry with subsequent process creation or persistence events to identify possible exploitation chains
Hunt for HTML pages served with heavy DOM manipulation and JavaScript garbage-collection triggers on newly registered or low-reputation domains

Monitoring Recommendations

Monitor endpoint detection and response (EDR) telemetry for anomalous child processes of Chrome renderer processes
Track Chrome update compliance across the fleet and alert on stale versions
Log and review DNS and web proxy activity for connections to newly observed domains referenced from suspicious HTML documents

How to Mitigate CVE-2026-79198

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Verify that Chromium-based browsers in the environment have incorporated the corresponding upstream fix
Restart browser sessions after patch deployment to ensure the vulnerable process is unloaded

Patch Information

Google addressed CVE-2026-79198 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Administrators should force an update through Chrome's built-in updater, Google Update policies, or their enterprise browser management tooling. Fleet-wide deployment should be prioritized because the vulnerability is remotely reachable and requires only that a user opens a malicious page.

Workarounds

Restrict browsing to trusted sites via web filtering or DNS-based reputation controls until patches are applied
Enforce Chrome enterprise policies that disable unnecessary features and require automatic updates
Use application allow-listing to prevent unauthorized child processes from executing after a browser compromise

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force a Chrome update check on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --check-for-update-interval=1