CVE-2026-79132: Improper input validation in Google Chrome

This vulnerability in Google Chrome on Android arises from improper input validation in the browser's input handling. An attacker who has already compromised the renderer process could exploit this flaw by delivering a specially crafted HTML page, enabling arbitrary code execution outside the sandbox environment. This elevates the attacker's capabilities beyond the renderer process sandbox, increasing the potential impact. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution outside the sandbox, which can lead to full compromise of the affected device's browser process and potentially the underlying system. This elevates the attacker's control and can result in data theft, system manipulation, or further attacks. However, exploitation requires prior compromise of the renderer process and user interaction.

The vendor advisory link provided should be consulted for the latest remediation status. The affected version is prior to 152.0.7977.65 on Android, so updating to version 152.0.7977.65 or later is recommended if confirmed by the vendor advisory. Patch status is not explicitly confirmed in the input data; therefore, check the vendor advisory for current remediation guidance.