CVE-2026-79083: Improper enforcement of behavioral workflow in Google Chrome

CVE-2026-79083 is a high-severity vulnerability in Google Chrome's media handling prior to version 152.0.7977.65. It stems from improper enforcement of behavioral workflow, which enables a remote attacker with control over the renderer process to potentially execute arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. This bypasses sandbox protections and could lead to full code execution on the host system. The vulnerability is publicly disclosed and assigned a CVSS v3.1 score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation allows arbitrary code execution outside the sandbox, which can compromise the host system's security, leading to potential full system compromise. The attacker must have already compromised the renderer process and trick the user into interacting with a crafted HTML page. The impact includes full confidentiality, integrity, and availability loss on the affected system.

Google has released an update to address this vulnerability in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to mitigate the risk. Since this is a client-side software vulnerability, patching the browser is the primary remediation step. No additional mitigations are specified in the vendor advisory.