CVE-2026-79249: Google Chrome Bisection RCE Vulnerability

CVE-2026-79249 Overview

CVE-2026-79249 is a code injection vulnerability in the Bisection component of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain sensitive information by convincing a user to open a crafted file. The flaw is categorized under CWE-94: Improper Control of Generation of Code and requires user interaction to trigger. Google rates the Chromium security severity as Medium.

Critical Impact
Successful exploitation allows a remote attacker to read sensitive information from a targeted user through a crafted file processed by Chrome's Bisection functionality.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the same Bisection component
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-08-25 - CVE-2026-79249 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79249

Vulnerability Analysis

The vulnerability resides in the Bisection feature of Google Chrome, which is used during debugging and regression analysis workflows. Improper control over dynamically generated or interpreted code enables a crafted input file to influence execution context. An attacker exploits this by delivering a specially prepared file that the browser processes through the affected code path.

The outcome is information disclosure rather than arbitrary code execution or integrity impact. Confidentiality is compromised because attacker-influenced code paths can read data the browser process holds. Exploitation is remote over the network but requires the user to open or interact with the malicious file.

External references from the vendor include the Google Chrome Stable Update announcement and Chromium Issue Tracker #523232966.

Root Cause

The root cause is improper control of code generation (CWE-94) within the Bisection component. Input from a crafted file is incorporated into code that is subsequently evaluated without sufficient validation or sandboxing of the generated content.

Attack Vector

Exploitation requires network delivery of a crafted file and user interaction to open it in a vulnerable Chrome build. No privileges or prior authentication are required on the target. The scope remains unchanged, and only confidentiality is affected. See the vendor advisory linked above for technical specifics.

Detection Methods for CVE-2026-79249

Indicators of Compromise

Chrome browser processes loading unexpected files from downloaded or emailed sources followed by outbound connections to unfamiliar hosts.
Presence of Chrome versions earlier than 152.0.7977.65 reporting in endpoint inventory.
Renderer or utility process reading local files inconsistent with normal user browsing activity.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 152.0.7977.65.
Monitor for crafted file types delivered via email or web downloads that target Chrome's Bisection or debugging workflows.
Correlate browser process telemetry with unusual file reads and outbound network activity to detect information disclosure attempts.

Monitoring Recommendations

Enable browser telemetry forwarding to a centralized log platform for behavioral analysis.
Alert on Chrome processes spawning unusual child processes or accessing sensitive user directories after opening downloaded files.
Track patch compliance and generate reports on endpoints still running vulnerable Chrome builds.

How to Mitigate CVE-2026-79249

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Verify Chromium-based browsers in the environment have integrated the corresponding fix.
Restrict opening untrusted files delivered through email, chat, or web downloads until patching completes.

Patch Information

Google published the fix in the Chrome Stable channel release documented in the Chrome Releases blog. Administrators should enforce automatic updates and validate that endpoints have restarted the browser to apply the patched binaries. Track remediation status through the Chromium Issue Tracker entry.

Workarounds

Disable or avoid use of Bisection debugging workflows on unpatched builds.
Apply enterprise policies that block execution of untrusted file types associated with the attack vector.
Segment high-risk users behind web filtering that inspects and blocks suspicious file downloads.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update via enterprise policy check (Windows)
reg query "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault