CVE-2026-78952: Out of bounds write in Google Chrome

This vulnerability involves an out-of-bounds write in the Crashpad component of Google Chrome on Windows platforms before version 152.0.7977.65. An attacker who has already compromised the renderer process can leverage this flaw to execute arbitrary code outside the sandbox environment by delivering a specially crafted HTML page. The flaw is classified with a high severity and a CVSS 3.1 base score of 8.3, reflecting its potential impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on August 25, 2026, and a Google Chrome stable channel update announcement is linked as the vendor advisory.

Successful exploitation allows remote code execution outside the sandbox, which can lead to full compromise of the affected system's security context. The vulnerability impacts confidentiality, integrity, and availability of the system. However, exploitation requires prior compromise of the renderer process and user interaction (UI required). No active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update announcement should be monitored for official patch availability and instructions. Until a patch is confirmed, users should exercise caution with untrusted HTML content and ensure Chrome updates are applied promptly once available.