CVE-2026-79245: Use after free in Google Chrome

This vulnerability involves a use-after-free condition in the UI of Google Chrome before version 152.0.7977.65. Exploitation requires local attacker access with prior compromise of the renderer process. Successful exploitation can lead to arbitrary code execution outside the sandbox, elevating privileges locally. The CVSS vector indicates the attack requires local access (AV:L), high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), and impacts confidentiality, integrity, and availability with high severity (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

An attacker with local access and control over the renderer process can execute arbitrary code outside the sandbox, potentially leading to full compromise of the local system. The vulnerability affects confidentiality, integrity, and availability of the system. However, exploitation requires prior compromise of the renderer process and user interaction, which limits remote exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Users should update Google Chrome to version 152.0.7977.65 or later once the fix is officially released. Until then, limit local access and monitor for suspicious activity related to the renderer process compromise.