CVE-2026-78999: Improper privilege management in Google Chrome

This vulnerability in Google Chrome's navigation component allows an attacker with control over the renderer process to escalate privileges and execute arbitrary code outside the sandbox environment. Exploitation requires social engineering to lure the victim to a maliciously crafted HTML page. The flaw affects Chrome versions prior to 152.0.7977.65. The vulnerability is rated with a CVSS 3.1 score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation can lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. This can result in full system compromise, data theft, or further attacks on the victim's system. The vulnerability affects confidentiality, integrity, and availability of the affected system.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html provides official update guidance.