CVE-2026-78985: Incorrect reference resolution in Google Chrome

This vulnerability in Google Chrome's FileSystem feature allows incorrect reference resolution, which can be exploited by a remote attacker through social engineering with a crafted HTML page. Successful exploitation could lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. The issue affects versions prior to 152.0.7977.65. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

An attacker can execute arbitrary code outside the sandbox environment of Google Chrome, potentially leading to full compromise of the affected system. This can result in unauthorized access, data theft, or system manipulation. The vulnerability requires user interaction via social engineering but does not require prior privileges.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for detailed update instructions.