CVE-2026-79072: Improper state validation in Google Chrome

This vulnerability, identified as CVE-2026-79072, affects Google Chrome versions before 152.0.7977.65. It stems from improper state validation within the Performance feature of the browser. An attacker could exploit this flaw by delivering a specially crafted HTML page that enables reading of memory inside the sandbox environment, potentially exposing sensitive information. The CVSS 3.1 vector indicates the attack requires no privileges and user interaction but can be executed remotely over the network, resulting in high confidentiality and integrity impact without affecting availability.

Successful exploitation could lead to unauthorized disclosure of information by reading memory inside the sandboxed environment of the browser. This compromises confidentiality and integrity of data processed by Chrome. There is no indication of impact on availability. No known active exploits have been reported.

The vendor has released a stable channel update as per the advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. While the exact patch status is not explicitly stated in the provided data, the presence of a stable channel update strongly suggests that a fix is available in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability.