CVE-2026-84324: Google Chrome Proxy Use After Free Flaw

CVE-2026-84324 Overview

CVE-2026-84324 is a use-after-free vulnerability in the Proxy component of Google Chrome prior to version 152.0.7977.75. A remote attacker can exploit the flaw through crafted network traffic to execute arbitrary code outside the browser sandbox. The Chromium project classified this issue with a security severity of High, and the CWE mapping is [CWE-416].

Successful exploitation grants attackers code execution with the privileges of the browser process outside the sandbox boundary. This elevates the risk beyond typical renderer compromises because it bypasses one of Chrome's core containment mechanisms.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox by delivering crafted network traffic to a vulnerable browser instance.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.75
Chromium-based browsers incorporating the vulnerable Proxy code path
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-09-02 - CVE-2026-84324 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84324

Vulnerability Analysis

The flaw is a use-after-free (UAF) condition in Chrome's Proxy component. In this class of memory corruption, code references heap memory after that memory has been released, allowing an attacker who controls subsequent heap allocations to place attacker-chosen data where a valid object is expected.

When the Proxy component dereferences the stale pointer, attacker-controlled data is interpreted as an object, function pointer, or virtual table entry. This primitive can be developed into arbitrary code execution in the browser process. Because the exploitation path leads outside the sandbox, standard renderer isolation does not contain the attacker.

Root Cause

The root cause is improper lifetime management of an object owned by the Proxy component ([CWE-416]). A reference to a freed object remains reachable and is later dereferenced during proxy-related operations triggered by network activity. Detailed patch and object information is tracked in Chromium Issue #533534913.

Attack Vector

Exploitation occurs over the network. An attacker delivers crafted traffic that reaches Chrome's Proxy handling logic, drives the object into a freed state, and then triggers the dangling reference. No authentication is required, and user interaction is not needed according to the published CVSS metrics. High attack complexity reflects the memory-shaping steps required to reliably control the freed slot.

See the Google Chrome Stable Update for release-level context. Because the CVE data does not include public exploit code or proof-of-concept references, technical exploitation details are described in prose rather than sample code.

Detection Methods for CVE-2026-84324

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command interpreters or scripting engines shortly after network activity
Crashes or exceptions in chrome.exe originating from Proxy-related modules, especially on hosts running versions earlier than 152.0.7977.75
Outbound connections from Chrome to unfamiliar hosts followed by process behavior inconsistent with normal browsing

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build prior to 152.0.7977.75
Monitor endpoint telemetry for post-exploitation behaviors such as browser process injection, credential access, or persistence attempts originating from Chrome
Correlate proxy configuration changes and unexpected PAC script fetches with subsequent anomalous process activity

Monitoring Recommendations

Enable behavioral endpoint detection focused on browser process lineage and memory-integrity violations
Ingest browser and endpoint logs into a centralized SIEM or data lake to hunt for Chrome crash patterns tied to Proxy modules
Track browser version compliance continuously and alert when hosts drift below the patched build

How to Mitigate CVE-2026-84324

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded across all sessions
Apply matching updates to Chromium-based browsers once vendors publish equivalent builds

Patch Information

Google addressed CVE-2026-84324 in the Chrome Stable channel at version 152.0.7977.75. Refer to the Google Chrome Stable Update advisory and Chromium Issue #533534913 for the authoritative fix reference. Enterprises using managed Chrome deployments should push the update through their standard software distribution channels and verify version compliance.

Workarounds

Restrict outbound proxy usage to trusted, authenticated proxies where feasible until patching completes
Enforce enterprise policy to block execution of untrusted Chrome extensions that could amplify exploitation impact
Segment high-value hosts and require web traffic to traverse inspection points capable of blocking anomalous proxy traffic

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output should be 152.0.7977.75 or later