CVE-2026-79200 Overview
CVE-2026-79200 is a use-after-free vulnerability [CWE-416] in the Aura component of Google Chrome. Aura is the cross-platform windowing and UI framework that Chrome uses for rendering browser widgets. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can trigger the condition by convincing a user to load a crafted HTML page. Successful exploitation allows arbitrary code execution outside of the Chrome sandbox. Google's Chromium team rates the underlying security severity as Critical.
Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox, enabling attackers to run native code on the victim's system with the privileges of the browser user.
Affected Products
- Google Chrome for Desktop versions prior to 152.0.7977.65
- Chromium-based browsers incorporating the vulnerable Aura component
- All operating systems where the affected Chrome desktop builds are distributed
Discovery Timeline
- 2026-08-25 - CVE-2026-79200 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in the NVD database
Technical Details for CVE-2026-79200
Vulnerability Analysis
The vulnerability is a use-after-free condition in Chrome's Aura subsystem. Aura manages window objects, event routing, and compositing for the browser UI. A use-after-free occurs when code continues to reference memory that has already been released, allowing attacker-controlled data to occupy the freed allocation.
Because the flaw resides in Aura rather than the renderer alone, exploitation can achieve code execution outside the Chrome sandbox. This removes a key mitigation layer that normally contains renderer compromises. The attack requires user interaction, specifically loading a crafted HTML page, but does not require authentication or elevated privileges on the target host.
Root Cause
The root cause is improper lifetime management of an Aura object [CWE-416]. Chrome frees the underlying allocation while another code path retains a dangling reference to it. When the stale reference is later dereferenced, the process operates on memory that an attacker can reshape through carefully sequenced DOM, layout, or window manipulation from the crafted page.
Attack Vector
Exploitation begins when a user visits an attacker-controlled or compromised web page. The page uses JavaScript and HTML content designed to force allocation, deallocation, and reuse of the vulnerable Aura object. Once the freed slot is reoccupied with attacker-controlled data, dereferencing the dangling pointer redirects execution or corrupts memory. The attacker chains this into arbitrary code execution outside the sandbox. See the Chromium Issue Tracker entry and the Google Chrome Desktop Update for release-level details.
No verified proof-of-concept code is currently available. Technical specifics of the trigger remain restricted while users update.
Detection Methods for CVE-2026-79200
Indicators of Compromise
- Unexpected child processes spawned by chrome.exe (or the platform equivalent), particularly command shells, script hosts, or LOLBins launched from a browser parent.
- Chrome renderer or browser process crashes with access-violation signatures shortly before or during suspicious child-process activity.
- Outbound connections from Chrome processes to newly registered or low-reputation domains hosting HTML payloads.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65 as vulnerable.
- Alert on browser processes writing executables, DLLs, or scheduled-task artifacts to disk, which is atypical for normal browsing.
- Correlate browser crash telemetry with subsequent process-creation and network events to identify likely post-exploitation.
Monitoring Recommendations
- Ingest endpoint process, file, and network telemetry into a centralized analytics platform to enable cross-event correlation.
- Monitor EDR alerts tagged to browser exploitation techniques such as MITRE ATT&CK T1189 (Drive-by Compromise) and T1203 (Exploitation for Client Execution).
- Track Chrome update compliance continuously rather than at scheduled intervals to shorten exposure windows.
How to Mitigate CVE-2026-79200
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Restart Chrome after the update installs; the patched binary is not active until the browser process is relaunched.
- Push the update to unmanaged and BYOD devices through mobile device management or user communication.
Patch Information
Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Refer to the Google Chrome Desktop Update advisory for the full list of fixes in this release and to the Chromium Issue Tracker #532921800 for the tracking record. Chromium-derived browsers should apply the corresponding upstream patch as vendors publish their builds.
Workarounds
- No vendor-supplied workaround replaces the patch. Updating Chrome is the required remediation.
- Restrict browsing to trusted sites and enforce web content filtering to reduce exposure to crafted HTML pages while updates roll out.
- Enforce least-privilege user accounts so that any successful sandbox escape executes with reduced local privileges.
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected: Google Chrome 152.0.7977.65 or later
# Windows: query installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
