CVE-2026-84349: Google Chrome Use-After-Free Vulnerability

CVE-2026-84349 Overview

CVE-2026-84349 is a use-after-free vulnerability in the Browser component of Google Chrome prior to version 152.0.7977.75. A remote attacker who has already compromised the renderer process can exploit the flaw to execute arbitrary code outside the Chrome sandbox. Exploitation requires user interaction with a crafted HTML page. Google classified the Chromium security severity as High. The weakness maps to CWE-416, Use After Free.

Critical Impact
Successful exploitation enables sandbox escape and arbitrary code execution in the browser process, giving attackers access to resources normally isolated from web content.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.75
Chromium-based browsers that share the vulnerable Browser process code path
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-09-02 - CVE-2026-84349 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84349

Vulnerability Analysis

The flaw resides in Chrome's Browser process, the privileged parent that brokers access to the operating system on behalf of sandboxed renderer processes. A use-after-free condition allows an attacker to reference memory in the Browser process after it has been released. Because the Browser process runs outside the renderer sandbox, corrupting its state can be leveraged to execute code with the browser's privileges. This class of bug is the primary vector for chained sandbox escapes in modern Chromium exploitation.

The attack chain assumes the renderer process is already compromised, typically through a prior renderer bug delivered via a crafted HTML page. The attacker then triggers the Browser-side use-after-free through crafted inter-process communication (IPC) messages sent from the compromised renderer. Refer to the Google Chrome Stable Update and Chromium Issue Tracker #537105664 for vendor context.

Root Cause

The root cause is improper object lifetime management in the Browser process. Code retains a pointer or handle to an object after that object's memory has been freed, allowing subsequent operations to dereference stale memory. Attackers reallocate the freed region with controlled data and hijack execution flow when the dangling reference is used.

Attack Vector

Exploitation requires network-delivered content and user interaction such as visiting a malicious page. The attacker must first compromise the renderer process, then send crafted messages to trigger the Browser-side free-then-use sequence. Because the scope is changed, successful exploitation impacts resources beyond the vulnerable process, enabling code execution outside the sandbox.

No verified proof-of-concept code is publicly available for this issue. Chromium restricts bug details until a majority of users have updated.

Detection Methods for CVE-2026-84349

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on Linux and macOS
Unusual outbound network connections initiated by the Chrome Browser process shortly after visiting an untrusted page
Crash telemetry referencing heap corruption or access violations in the Browser process on pre-patch Chrome versions

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.75
Alert on Chrome process trees where the parent Browser process writes executables, modifies autoruns, or loads unsigned modules
Correlate browser crash reports with subsequent suspicious process or network activity on the same host

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake for cross-source correlation
Track Chromium security release notes and map published CVEs to observed browser versions in the environment
Monitor for post-exploitation behaviors such as credential access, browser data theft, and lateral movement following browser exploitation

How to Mitigate CVE-2026-84349

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after applying the update to ensure the patched Browser process is running
Apply corresponding updates for Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi as vendors release fixes

Patch Information

Google addressed the vulnerability in the Chrome Stable Channel update to 152.0.7977.75. See the Google Chrome Stable Update announcement for release details and the Chromium Issue Tracker #537105664 for the underlying bug reference. Enterprise administrators should push the update through their standard software distribution mechanism and verify version compliance.

Workarounds

Enable Chrome's automatic updates and enforce restart policies through group policy or MDM to shorten patch exposure windows
Restrict browsing to trusted sites via enterprise policy where feasible until patch deployment completes
Consider Site Isolation enforcement and disabling unnecessary browser features to reduce the renderer attack surface used to reach this bug

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: check version from the application bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString