CVE-2026-79247: Google Chrome Use After Free Vulnerability

CVE-2026-79247 Overview

CVE-2026-79247 is a use-after-free vulnerability in the Chromoting component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the Chrome sandbox by delivering crafted network traffic. The weakness is classified as [CWE-416] Use After Free and Chromium's internal severity rating is High.

Critical Impact
Sandbox escape leading to arbitrary code execution on the host operating system, giving attackers a path from a compromised renderer to the user's Windows session.

Affected Products

Google Chrome on Windows versions prior to 152.0.7977.65
Microsoft Windows platform builds running the vulnerable Chrome release
Chromium-based components that ship the Chromoting subsystem on Windows

Discovery Timeline

2026-08-25 - CVE-2026-79247 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79247

Vulnerability Analysis

The vulnerability resides in Chromoting, the remote desktop framework that underlies Chrome Remote Desktop. Chromoting manages network sessions and control channels that traverse process boundaries, including the sandboxed renderer and higher-privileged broker processes. A use-after-free condition in this component allows an attacker to reference freed memory during message handling. Because Chromoting communicates across the sandbox boundary, memory corruption in the receiving process leads to code execution outside the renderer sandbox. The result is a full sandbox escape from a renderer that the attacker already controls.

Root Cause

The root cause is improper object lifetime management inside Chromoting. Specific object instances are freed while references remain reachable through inbound network messages. Subsequent operations dereference these dangling pointers and interpret attacker-influenced memory as valid C++ objects. Detailed source-level information is tracked in Chromium Issue Tracker #515473074.

Attack Vector

Exploitation requires two stages. First, the attacker compromises the renderer process, typically through a separate web-based bug. Second, the attacker sends crafted network traffic that reaches the Chromoting message handler and triggers the use-after-free. Because the attack is network-delivered, requires user interaction to load malicious content, and crosses a security scope, the flaw carries a CVSS vector of AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.

No public proof-of-concept has been released, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.377%. See the Chromium Issue Tracker entry for technical details as they become available.

Detection Methods for CVE-2026-79247

Indicators of Compromise

Chrome renderer or broker processes (chrome.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Unexpected outbound connections from Chrome to non-Google infrastructure on ports associated with Chromoting relay traffic.
Crash dumps referencing the Chromoting or remoting:: namespaces on hosts running Chrome versions below 152.0.7977.65.

Detection Strategies

Inventory Chrome installations across Windows endpoints and flag any build earlier than 152.0.7977.65 as vulnerable.
Alert on process-lineage anomalies where Chrome parents native Windows shells or scripting hosts, which is uncommon during normal browsing.
Correlate Chrome crash telemetry with subsequent process creation events to identify successful post-exploitation activity.

Monitoring Recommendations

Ingest endpoint process, network, and crash telemetry into a centralized data lake for retrospective hunting once patches are deployed.
Track Chrome auto-update status through management tooling and generate exceptions for endpoints stalled on vulnerable versions.
Monitor Chrome Remote Desktop host and client usage, particularly on systems that do not require the feature for legitimate work.

How to Mitigate CVE-2026-79247

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 152.0.7977.65 or later.
Force a browser restart after the update so that the patched binaries load into memory.
Verify Chrome auto-update service health, since renderers running stale builds remain exposed until relaunched.
Restrict use of Chrome Remote Desktop to hosts that require it and disable the extension elsewhere through enterprise policy.

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Desktop Update advisory. The fixed version is 152.0.7977.65. Managed environments should push the update through Group Policy, Microsoft Intune, or the Chrome Enterprise update server. End-user machines will receive the update through the standard auto-update mechanism upon browser restart.

Workarounds

Disable Chrome Remote Desktop through the RemoteAccessHostFirewallTraversal and related enterprise policies until patching completes.
Enforce site isolation and strict extension allowlists to reduce the likelihood of renderer compromise in the first exploitation stage.
Block outbound traffic to Chromoting relay endpoints for user populations that do not require remote desktop functionality.

bash

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v "RemoteAccessHostFirewallTraversal" /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "RemoteAccessHostAllowRemoteAccessConnections" /t REG_DWORD /d 0 /f

# Verify installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion