Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-79012: Chrome for Mac can run malicious code via fake page

CVE-2026-79012 · published 2 months ago

Summary

Google Chrome on Mac versions before 152.0.7977.65, and the Debian Chromium build, can be tricked by a specially crafted web page to run code outside the browser’s security container. An attacker could use social engineering to make a user open such a page and gain control of the computer. Install the latest Chrome or Chromium update as soon as possible to close this risk.

What to do

Update google chrome to version 152.0.7977.65 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	chrome	< 152.0.7977.65 `cpe:2.3:a:google:chrome::::::::`
Debian:11	debian	chromium	All versions
Debian:12	debian	chromium	All versions
Debian:13	debian	chromium	All versions
Debian:14	debian	chromium	All versions

Original advisory text

Use after free in Safebrowsing in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted ...

References

https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
https://issues.chromium.org/issues/523704817 Permissions Required
https://security-tracker.debian.org/tracker/CVE-2026-79012 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published25 Aug 2026

Updated4 Nov 2026

First seen26 Aug 2026

Sources

DEBIAN-CVE-2026-79012 · OSV

CVE-2026-79012 · NVD

CVE-2026-79012 · MITRE

Track software like this

Free during beta