CVE-2026-79256: Externally controlled reference in Google Chrome

This vulnerability (CVE-2026-79256) affects Google Chrome on Android versions before 152.0.7977.65. It arises from an externally controlled reference in the WebView component, which could be exploited by a remote attacker with control over the renderer process to execute arbitrary code outside the sandbox environment. The CVSS 3.1 vector indicates network attack vector with high complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vulnerability is classified as high severity by Chromium security.

Successful exploitation could allow an attacker who has compromised the renderer process to execute arbitrary code outside the sandbox, potentially leading to full compromise of the affected device's security boundaries. This impacts confidentiality, integrity, and availability of the system. However, exploitation requires prior compromise of the renderer process and user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Users and administrators should monitor for updates and apply them once available to mitigate this vulnerability.