CVE-2026-84350: Google Chrome Use After Free Vulnerability

CVE-2026-84350 Overview

CVE-2026-84350 is a use-after-free vulnerability in the TabStrip component of Google Chrome versions prior to 152.0.7977.75. A remote attacker who convinces a user to perform specific UI interactions can trigger the flaw and execute arbitrary code outside the Chrome sandbox. The issue is tracked under [CWE-416] and affects the desktop stable channel of Chromium-based browsers. Google has published a fix in the stable channel update announcement. While the Chromium project rated the underlying issue as Low internally, the NVD score reflects a higher exploitation impact because a successful attack breaks out of the renderer sandbox.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox on the victim host, enabling full compromise of the user session.

Affected Products

Google Chrome desktop stable channel prior to 152.0.7977.75
Chromium-based browsers embedding the vulnerable TabStrip UI code
Downstream distributions shipping affected Chromium builds

Discovery Timeline

2026-09-02 - CVE-2026-84350 published to the National Vulnerability Database
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84350

Vulnerability Analysis

The defect resides in Chrome's TabStrip, the browser UI component that manages tab creation, ordering, dragging, and destruction. A use-after-free condition arises when the code path retains a pointer to a TabStrip-owned object after that object has been freed. Subsequent UI interactions dereference the stale pointer, allowing an attacker to control freed memory contents.

Because TabStrip runs in the privileged browser process rather than a sandboxed renderer, memory corruption here yields code execution outside the renderer sandbox. That elevates a typical browser bug from renderer compromise to full user-context execution on the host.

Root Cause

The root cause is an object lifetime mismatch in TabStrip. A referenced object is destroyed while another code path still holds a raw pointer to it. The condition maps to [CWE-416] Use After Free. Chromium's ongoing MiraclePtr and RawPtr hardening work targets this class of defect, but the specific call path in TabStrip was not covered before the fix in 152.0.7977.75.

Attack Vector

Exploitation requires the victim to visit attacker-controlled content and perform UI interactions such as clicking, dragging tabs, or dismissing prompts, as reflected by the UI:R metric in the CVSS vector. The attacker crafts web content that triggers the vulnerable code path in the browser process, then grooms the heap to place controlled data where the freed TabStrip object resided. A subsequent dereference redirects control flow to attacker-supplied logic.

No authenticated access and no local access are required. However, social engineering is necessary to induce the UI interaction. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for the vendor's technical context.

Detection Methods for CVE-2026-84350

Indicators of Compromise

Unexpected child processes spawned by chrome.exe or the browser process on macOS and Linux following a browsing session
Crash reports or WerFault.exe events referencing the Chrome browser process and TabStrip frames
Outbound connections to newly registered domains immediately after a user opened a link or attachment in the browser

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.75 as vulnerable
Hunt for browser process crashes containing use-after-free signatures in the TabStrip symbol range
Correlate suspicious process creation events where the parent is a Chrome browser process and the child performs discovery or credential access activity

Monitoring Recommendations

Ingest endpoint telemetry that captures browser process ancestry, module loads, and crash dumps into your detection pipeline
Alert on Chrome browser processes writing executables or scheduled tasks, which is atypical post-exploitation behavior
Track browser version compliance metrics and generate exceptions when devices fail to update within your SLA

How to Mitigate CVE-2026-84350

Immediate Actions Required

Update Google Chrome to version 152.0.7977.75 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update installs so the patched binary is loaded into memory
Verify managed browser policies allow automatic updates and are not pinning older builds

Patch Information

Google addressed the vulnerability in the Chrome stable channel at version 152.0.7977.75. Refer to the Google Chrome Stable Update announcement for release details. Chromium-based browser vendors including Microsoft Edge, Brave, Opera, and Vivaldi should be updated once they publish rebases against the fixed Chromium version.

Workarounds

Instruct users to avoid interacting with untrusted links, popups, or tab-drag prompts until patches are deployed
Enforce site isolation and disable unnecessary Chrome experiments through enterprise policy
Restrict browser execution to standard user accounts and block the browser process from writing to sensitive directories via application control policies

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify on Linux
google-chrome --version