CVE-2026-79139: Improper input validation in Google Chrome

This vulnerability in Google Chrome's Media component on Windows arises from improper input validation. An attacker who has already compromised the renderer process could exploit this flaw by delivering a specially crafted HTML page, potentially enabling arbitrary code execution outside the browser sandbox. This elevates the attacker's capabilities beyond the renderer process sandbox restrictions. The issue affects Chrome versions prior to 152.0.7977.65. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with control over the renderer process to execute arbitrary code outside the sandbox, potentially compromising the host system's security. This can lead to full system compromise or unauthorized actions beyond the browser's sandbox restrictions.

A fixed version is available in Google Chrome 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked provides official confirmation of the update. No additional mitigations are specified.