CVE-2026-79290: Google Chrome Aura Use After Free Vulnerability

CVE-2026-79290 Overview

CVE-2026-79290 is a use-after-free vulnerability [CWE-416] in the Aura component of Google Chrome. Aura is the cross-platform window and UI framework used by Chromium to render browser windows, menus, and desktop widgets. A remote attacker can exploit the flaw by serving a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google Chromium rates the severity as Critical. The issue affects Chrome desktop builds prior to version 152.0.7977.65 and requires user interaction, such as visiting a malicious page.

Critical Impact
Remote attackers can escape the Chrome sandbox and execute arbitrary code on a target host after luring the user to a crafted web page.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Aura component
Applications using Chromium Embedded Framework builds prior to the fix

Discovery Timeline

2026-08-25 - CVE-2026-79290 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79290

Vulnerability Analysis

The flaw resides in Aura, Chromium's platform-independent windowing and compositing framework. A use-after-free condition occurs when code retains a pointer to an Aura object after that object has been released. When the freed memory is reused, the dangling reference lets an attacker corrupt object state and hijack control flow.

Because Aura runs across browser process boundaries and handles UI events, exploitation can reach code paths that operate outside the renderer sandbox. This distinguishes the bug from typical renderer-only use-after-free issues and explains the sandbox escape rating. Refer to the Chromium Issue Report #516427761 and the Chrome Stable Update Announcement for release-level context.

Root Cause

The root cause is improper lifetime management of an Aura object [CWE-416]. A raw pointer or weak reference outlives its owner, and subsequent access triggers dereference of freed heap memory. Attackers can groom the heap through JavaScript and DOM operations to place attacker-controlled data at the freed allocation.

Attack Vector

Exploitation requires a victim to load attacker-controlled HTML in a vulnerable Chrome build. The crafted page triggers the Aura code path that frees the target object, then reuses the dangling reference. Because the vulnerable component executes outside the renderer sandbox, successful exploitation yields arbitrary code execution in a higher-privilege browser process. No authentication is required, and the attack works over any network delivery channel that renders web content, including advertisements, iframes, and phishing links.

No public proof-of-concept code has been released. Technical details are described in prose per the referenced Chromium issue.

Detection Methods for CVE-2026-79290

Indicators of Compromise

Chrome or Chromium-based browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters
Browser processes writing executables or scripts to user-writable paths shortly after web navigation
Outbound connections from browser processes to newly registered or low-reputation domains hosting HTML payloads

Detection Strategies

Monitor for anomalous parent-child process relationships originating from chrome.exe or the Chromium binary
Alert on browser processes loading unsigned modules or performing memory operations consistent with exploitation primitives
Correlate browser crash telemetry that references Aura components with subsequent suspicious process activity

Monitoring Recommendations

Ingest browser process telemetry, EDR events, and DNS logs into a central data lake for cross-source correlation
Track Chrome version inventory across managed endpoints and flag hosts running builds earlier than 152.0.7977.65
Review web proxy logs for user navigation to suspicious HTML resources preceding endpoint alerts

How to Mitigate CVE-2026-79290

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed desktops
Restart Chrome after installation to ensure the patched binaries are loaded into memory
Audit Chromium-based applications and embedded frameworks for vulnerable builds and apply vendor updates

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65. Deployment details are in the Chrome Stable Update Announcement. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their preferred patch management platform.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patching completes
Enable site isolation and strict HTTPS enforcement policies through Chrome enterprise policy
Disable execution of untrusted browser extensions that could amplify exploitation impact

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version