Executive brief
Google Chrome's sandbox is a security boundary designed to isolate web content and limit the damage if the browser is compromised. This vulnerability allows an attacker who has already compromised Chrome's renderer process to bypass sandbox restrictions and execute arbitrary code outside the sandbox, potentially gaining full control of the user's computer. The flaw affects Chrome versions prior to 152.0.7977.65 and requires an attacker to first compromise the renderer process through another vulnerability.
Technical details
This is an authorization flaw in Chrome's sandbox mechanism (CVE-2026-79218). The vulnerability allows a remote attacker who has compromised the renderer process to escape sandbox restrictions and execute arbitrary code outside the sandbox via a crafted HTML page. The attack requires the renderer process to already be compromised, making this a secondary exploit that follows an initial code execution bug. No user interaction beyond visiting a malicious web page is required once the renderer is compromised. The vulnerability was patched in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65