CVE-2026-78934: Race condition in Google Chrome

CVE-2026-78934 is a race condition vulnerability in the ReadAloud component of Google Chrome versions before 152.0.7977.65. Exploitation requires user interaction via social engineering to execute arbitrary code within the sandbox environment. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.3, indicating network attack vector, high complexity, no privileges required, user interaction needed, and complete impact on confidentiality, integrity, and availability. The vendor has published an advisory but has not explicitly confirmed a patch or remediation level.

Successful exploitation allows remote attackers to execute arbitrary code inside the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. The attack requires user interaction through social engineering and a crafted HTML page. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and avoid interacting with suspicious pages that could trigger the vulnerability.