CVE-2026-79231: Google Chrome Media Buffer Overflow RCE

CVE-2026-79231 Overview

CVE-2026-79231 is a heap buffer overflow [CWE-122] in the Media component of Google Chrome. Versions prior to 152.0.7977.65 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. The attack requires no authentication but does require user interaction, such as visiting a malicious or compromised website. Google's Chromium team assigned an internal severity of Medium, while the National Vulnerability Database rates it High.

Critical Impact
Remote arbitrary code execution inside the Chrome renderer sandbox through a crafted web page, impacting confidentiality, integrity, and availability of the browser process.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers that embed the vulnerable Media component
Downstream distributions shipping Chromium builds older than 152.0.7977.65

Discovery Timeline

2026-08-25 - CVE-2026-79231 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79231

Vulnerability Analysis

The flaw is a heap-based buffer overflow in Chrome's Media subsystem, which handles decoding and playback of audio and video streams inside the renderer process. An attacker delivers a crafted HTML page that triggers the Media pipeline with malformed input. Processing that input causes a write past the end of a heap-allocated buffer.

Successful exploitation corrupts adjacent heap memory. An attacker can use this corruption to hijack control flow within the renderer process. The resulting code execution is confined to the Chrome sandbox, but sandbox-contained code is a common first stage in exploit chains that pair with a sandbox escape.

The Exploit Prediction Scoring System places this issue in the lower range of near-term exploitation probability, but browser memory corruption bugs are historically attractive targets for exploit developers.

Root Cause

The root cause is improper bounds checking on heap allocations within the Media component. When the affected code path processes attacker-controlled media data, size calculations or copy operations fail to constrain writes to the allocated region. This pattern aligns with [CWE-122: Heap-based Buffer Overflow].

Attack Vector

Delivery is entirely network-based. An attacker hosts a malicious HTML page that references or embeds crafted media content. The victim triggers the vulnerability by visiting the page, opening a link, or loading an ad tag that references the payload. No credentials or elevated privileges are required on the target system.

No verified public exploit code is available. Refer to the Chromium Issue Tracker Entry and the Chrome Stable Channel Update for vendor technical details.

Detection Methods for CVE-2026-79231

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures while loading media-heavy pages
Outbound connections from chrome.exe child processes to unfamiliar domains immediately after visiting untrusted sites
Unexpected child processes spawned by Chrome renderer processes
Browser telemetry showing repeated media decode failures tied to a single origin

Detection Strategies

Inventory Chrome installations across the fleet and flag any build below 152.0.7977.65
Correlate web proxy logs with endpoint telemetry to identify users visiting attacker-controlled pages that serve malformed media
Alert on renderer process crashes followed by suspicious process creation, file writes, or network activity
Match observed behavior to MITRE ATT&CK techniques T1189 (Drive-by Compromise) and T1203 (Exploitation for Client Execution)

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation
Monitor for post-exploitation behaviors such as reconnaissance commands or credential access originating from Chrome child processes
Track Chrome version drift over time to catch unpatched hosts that miss automatic updates

How to Mitigate CVE-2026-79231

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Restart Chrome after update to ensure the patched binary is loaded
Force-deploy the update through enterprise management tooling where automatic updates are disabled
Audit Chromium-based browsers and embedded WebView components for equivalent patched builds

Patch Information

Google addressed the issue in the Chrome Stable channel with build 152.0.7977.65. Details are published in the Chrome Stable Channel Update. The associated bug entry is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites through web filtering and DNS policy until patches are deployed
Disable autoplay and limit media codec exposure through enterprise policy where feasible
Enforce Site Isolation and strict sandboxing policies through Chrome Enterprise settings
Apply application allowlisting to prevent unexpected process execution originating from renderer processes

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify on Linux
google-chrome --version