CVE-2026-79244: Google Chrome Animation Use After Free Flaw

CVE-2026-79244 Overview

CVE-2026-79244 is a use-after-free vulnerability [CWE-416] in the Animation component of Google Chrome prior to version 152.0.7977.65. A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The flaw affects the rendering pipeline responsible for handling animation objects, where freed memory can be reused to gain control of program flow. Chromium's security team rated this issue Low severity internally, though NVD scoring reflects HIGH impact due to network exploitability and full compromise of the affected renderer process.

Critical Impact
Remote attackers can execute arbitrary code within the Chrome sandbox by delivering a crafted HTML page to a target user.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers using the same upstream Animation code
All operating system builds shipped in the pre-152 stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79244 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79244

Vulnerability Analysis

The defect resides in the Animation subsystem of Blink, the rendering engine inside Chrome. Use-after-free conditions occur when code retains a pointer to a heap object after that object has been released. An attacker who influences the allocator state can place controlled data at the freed address. When the dangling pointer is dereferenced, the browser interprets attacker data as a valid object, enabling arbitrary code execution in the renderer process. Exploitation remains bounded by Chrome's sandbox, but successful renderer compromise is a common starting point for chained sandbox escapes.

Root Cause

The root cause is improper lifetime management of animation-related objects. A reference to an animation node persists after the underlying allocation is freed, likely through event dispatch or DOM manipulation that outlives the object owner. See the Chromium Issue Tracker entry for upstream discussion.

Attack Vector

Exploitation requires user interaction. A victim must visit a malicious or compromised web page that serves JavaScript and HTML crafted to trigger the use-after-free. No authentication is required, and the attack traverses the network. Delivery through malvertising, watering-hole compromise, or phishing links is consistent with historical Blink flaws.

No verified proof-of-concept code is publicly available. Refer to the Chrome Release Update for vendor-confirmed details.

Detection Methods for CVE-2026-79244

Indicators of Compromise

Renderer process crashes referencing Animation or Blink call stacks in Chrome crash reports
Outbound connections from chrome.exe child processes to newly registered or low-reputation domains after page loads
Unexpected child process creation from a renderer, indicating possible sandbox escape chaining

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65
Monitor browser telemetry for renderer crash signatures tied to animation object destruction
Correlate web proxy logs with endpoint process events to identify users landing on suspicious HTML payloads

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward crash and extension events into your SIEM
Alert on Chrome renderer processes spawning shells, script interpreters, or unusual binaries
Track patch compliance rates for Chrome and Chromium-based browsers as a recurring SOC metric

How to Mitigate CVE-2026-79244

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart browser sessions after deployment to ensure the patched binaries are loaded
Audit third-party Chromium-based browsers (Edge, Brave, Opera, Vivaldi) for equivalent fixes

Patch Information

Google addressed CVE-2026-79244 in the Chrome stable channel release documented in the Chrome Release Update. Administrators should confirm client versions report 152.0.7977.65 or higher after rollout.

Workarounds

Enforce Chrome auto-update policies through group policy or MDM to reduce dwell time on vulnerable versions
Restrict browsing to trusted domains via web filtering while patch deployment is in progress
Deploy Site Isolation and enhanced Safe Browsing settings to raise the cost of renderer exploitation

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version