CVE-2026-79290

This is a memory-safety bug in Google Chrome. Think of it like a key to a safe that, when the safe is handled the wrong way, lets an attacker reach tools they shouldn’t have access to—except the “tools” are malicious code that can escape Chrome’s usual protection.

This matters if your business computers use Google Chrome for everyday work like email links, document viewing, or visiting websites. The risk is present when a user visits a malicious web page created by an attacker. There’s no need for a login, but it depends on Chrome being an older version (prior to 152.0.7977.65). It’s only a risk if the vulnerable Chrome version is reachable through normal web browsing (i.e., users can load the attacker’s crafted page).

This is RED because the bug can be triggered simply by visiting a crafted HTML page and can lead to arbitrary code execution outside Chrome’s sandbox. Even without confirmed details of specific incidents in the provided reporting, the impact potential is high and the fix is straightforward (update Chrome to the fixed version).

Confirm exposure

• On each affected machine, open Chrome → Help → About Google Chrome.
• Record the installed version and compare it to 152.0.7977.65.
• Any version prior to 152.0.7977.65 is in the vulnerable range described.

Upgrade / remediation

• Upgrade Google Chrome to 152.0.7977.65 (fixed) or the newest version available.
• If you manage Chrome centrally (device policy/MDM), update the managed browser package so all user profiles and scheduled updates comply.

Workarounds if you can’t patch immediately

• Prevent access to untrusted or newly registered sites as much as practical (e.g., stricter web filtering, safer-browsing policy, and user guidance to avoid unknown links).
• Reduce exposure by limiting browser use on the most critical machines until the update is deployed.

What to monitor after updating

• Verify the installed version now shows 152.0.7977.65 or later.
• Watch for unusual browser behavior (unexpected downloads, prompts, or new browser extensions) on any systems where users may have visited suspicious pages.

Due date

• No CISA KEV listing or specific due date was provided in the findings.

Severity and class

• Classified as a Critical Chromium security issue and mapped to CWE-416 (Use After Free).

Mechanism / attack trigger

• The weakness is a memory lifetime error in Chrome’s Aura framework. An attacker can craft a malicious HTML page that triggers the use-after-free when a user visits it.
• The consequence, per the findings, is arbitrary code execution outside the sandbox (meaning the browser’s normal containment is bypassed).

Preconditions and reachability

• No authentication required, but user interaction is required (the victim must visit the crafted page).
• Reachability in default configuration: No was stated in the findings, indicating you should treat risk as dependent on whether users can reach attacker-controlled web content in practice and whether the vulnerable Chrome version is in use.
• Vulnerable only for Google Chrome prior to 152.0.7977.65.

Exploitation status

• No KEV listing was reported.
• No public exploit code was found in the provided findings.
• The provided news/recap material did not include a specific dated incident tied to this CVE.

Patch

• Fixed in Google Chrome 152.0.7977.65 per the patch findings.

Predicted likelihood

• A prediction was provided (EPSS-like), but it is not included in public-facing summaries here; the key point for action is the high impact and the availability of a fixed version.