CVE-2026-79257: Google Chrome Views Use After Free Flaw

CVE-2026-79257 Overview

CVE-2026-79257 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 152.0.7977.65. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked as [CWE-416] and carries a Chromium security severity of High. Google addressed the issue in the Stable Channel update for desktop.

Critical Impact
Successful exploitation allows arbitrary code execution outside the renderer sandbox, giving attackers control at the privilege level of the browser process on the victim host.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Views component
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79257 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79257

Vulnerability Analysis

The vulnerability resides in the Views subsystem, which is Chrome's cross-platform UI framework responsible for rendering browser chrome elements such as menus, dialogs, and tabs. A use-after-free condition occurs when Chrome accesses a Views object after its backing memory has been released. An attacker who can trigger the free path while a dangling reference remains can control the freed allocation and redirect execution flow.

Because the Views component runs inside the privileged browser process rather than the sandboxed renderer, exploitation results in code execution outside the sandbox. This bypasses one of Chromium's primary defense boundaries and grants access to local files, credentials, and inter-process communication channels available to the browser process.

The CVSS vector indicates the attack is delivered over the network and requires user interaction, consistent with drive-by browsing to attacker-controlled content. The scope change reflects the sandbox escape: impact extends beyond the vulnerable component to the underlying host session.

Root Cause

The root cause is improper object lifetime management in Views, classified under [CWE-416] Use After Free. A Views object is dereferenced after its owning container has released it, likely through re-entrant event processing or asynchronous callbacks that outlive the parent object. Details are restricted in Chromium Issue Tracker #517959443 pending broad patch adoption.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page triggers UI operations that manipulate Views object lifetimes, spraying the heap to reclaim the freed allocation with attacker-controlled data. Because User Interaction is required, delivery vectors include phishing links, malicious advertising, and compromised legitimate sites.

No public proof-of-concept or in-the-wild exploitation has been confirmed. Refer to the Chrome Stable Channel Update for the vendor advisory.

Detection Methods for CVE-2026-79257

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after browsing activity
Outbound connections from chrome.exe to newly registered or low-reputation domains hosting HTML payloads
Crash reports referencing views:: symbols with heap corruption signatures on Chrome versions below 152.0.7977.65

Detection Strategies

Inventory endpoints running Chrome and flag any installation reporting a version earlier than 152.0.7977.65
Hunt for anomalous process lineage where Chrome is the parent of scripting or LOLBin executables
Correlate Chrome crash telemetry with subsequent network beaconing or credential access activity

Monitoring Recommendations

Ingest browser process telemetry and Windows/macOS/Linux process creation events into a centralized analytics platform
Monitor for Chrome auto-update failures that leave hosts stranded on vulnerable builds
Track web proxy logs for user visits to unclassified domains delivering large or obfuscated JavaScript payloads targeting UI APIs

How to Mitigate CVE-2026-79257

Immediate Actions Required

Update Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart browser sessions after deployment to ensure patched binaries are loaded into memory
Audit Chromium-derived browsers such as Edge, Brave, Opera, and Vivaldi for corresponding vendor updates

Patch Information

Google released the fix in the Chrome Stable Channel update for desktop, version 152.0.7977.65. Administrators should validate patch rollout through enterprise management tooling such as Chrome Browser Cloud Management, Group Policy, or MDM. Confirm the deployed build via chrome://version or telemetry from endpoint management. See the Chrome Stable Channel Update advisory for the official release notes.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patch deployment completes
Disable execution of untrusted JavaScript via enterprise policy on high-risk endpoints
Deploy application-layer isolation such as Remote Browser Isolation for users handling sensitive workloads

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# macOS: check bundle version
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString