CVE-2026-79223: Google Chrome Information Disclosure Flaw

CVE-2026-79223 is an information disclosure vulnerability in Google Chrome caused by an integer overflow in Chromium. Attackers can exploit this flaw to read memory inside the sandbox through crafted files. This article covers technical details, affected versions, security impact, and mitigation steps.

CVE-2026-79223 Overview

CVE-2026-79223 is an integer overflow vulnerability [CWE-190] in Chromium affecting Google Chrome versions prior to 152.0.7977.65. A remote attacker can deliver a crafted file that triggers the overflow and reads memory contents inside the Chrome sandbox. Google classified the Chromium security severity as Low, but the National Vulnerability Database scored the issue in the High range because exploitation over the network can compromise confidentiality, integrity, and availability when the user interacts with attacker-supplied content.

Critical Impact
Remote attackers can read process memory inside the Chrome sandbox by convincing a user to open or process a crafted file, enabling information disclosure that supports further exploitation chains.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop Stable channel)
Chromium-based browsers that inherit the vulnerable code path
Downstream distributions that bundle the affected Chromium release

Discovery Timeline

2026-08-25 - CVE-2026-79223 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79223

Vulnerability Analysis

The vulnerability is an integer overflow within Chromium's file-processing logic. When Chrome parses a maliciously crafted file, arithmetic performed on size or offset fields wraps around the storage type's boundary. The resulting undersized allocation or miscalculated bounds allows the renderer to access memory adjacent to the intended buffer. The attacker gains a primitive to read process memory that remains inside the sandbox, which is useful for leaking pointers, defeating Address Space Layout Randomization (ASLR), and preparing follow-on exploitation stages. The bug requires user interaction, aligning with the UI:R component of the CVSS vector.

Root Cause

The root cause is unchecked arithmetic on attacker-controlled length or index values during file parsing in Chromium. Multiplying or adding untrusted 32-bit values without range validation permits wraparound, producing a smaller allocation than the code subsequently assumes. Subsequent read operations exceed the actual buffer size and expose adjacent heap memory. Integer overflow bugs of this class are catalogued under CWE-190.

Attack Vector

Exploitation is network-reachable and requires the victim to open a crafted file inside Chrome, either directly or through a web page that presents the file to the browser's parsers. No privileges are required. A successful attack yields a memory read primitive constrained to the renderer sandbox, but that primitive frequently serves as the first stage in multi-bug chains that also target renderer sandbox escapes.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker #530816571 and the Chrome Stable Update announcement.

Detection Methods for CVE-2026-79223

Indicators of Compromise

Chrome renderer processes crashing or restarting shortly after opening a specific attacker-supplied file type
Unexpected file downloads followed by Chrome parsing activity from untrusted domains
Endpoints running Chrome versions earlier than 152.0.7977.65

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions and flag any build below 152.0.7977.65
Correlate browser process crashes with recently rendered file types to identify potential exploitation attempts
Monitor web proxy logs for file downloads originating from low-reputation domains that trigger browser parsing routines

Monitoring Recommendations

Alert when browser child processes terminate abnormally with access violation exceptions
Track Chrome auto-update telemetry to confirm patched builds are deployed fleet-wide
Review Endpoint Detection and Response (EDR) telemetry for renderer processes spawning unusual child processes after file rendering

How to Mitigate CVE-2026-79223

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on all managed devices to ensure the patched binary is loaded into memory
Verify that Chromium-based browsers such as Microsoft Edge, Brave, and Opera have absorbed the upstream fix

Patch Information

Google released the fix in Chrome Stable 152.0.7977.65. Deployment details appear in the Chrome Stable Update announcement. Enterprise administrators should push the update through managed update policies rather than relying solely on background auto-update.

Workarounds

Restrict opening of untrusted files in Chrome through Group Policy or Mobile Device Management (MDM) file-handling controls until the patch is applied
Block downloads of high-risk file formats at the web proxy for unpatched hosts
Enable Chrome Enterprise's Safe Browsing enhanced protection to reduce exposure to malicious file delivery