Executive brief
Google Chrome for macOS contains a use-after-free memory safety bug in the Views UI framework that allows remote attackers to execute arbitrary code outside the browser sandbox by visiting a crafted webpage. This bypasses Chrome's principal security boundary and could enable attackers to compromise the entire system beyond the browser process.
Technical details
CVE-2026-79128 is a use-after-free vulnerability in the Views component of Google Chrome on macOS, affecting versions prior to 152.0.7977.65. The vulnerability is triggered by a crafted HTML page served over the network, requiring no user interaction beyond visiting the page. Successful exploitation allows an attacker to execute arbitrary code outside the browser's sandbox environment, effectively bypassing Chrome's primary isolation mechanism. While Google rates this as Medium severity from a Chromium perspective, the ability to escape the sandbox elevates the practical impact. The vulnerability was fixed in Chrome 152.0.7977.65/152.0.7977.64.
Affected products
- Google Chrome prior to 152.0.7977.65 on macOS
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65 for macOS