Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-79195: Chrome before 152 allows remote code execution via web page

CVE-2026-79195 · published 2 months ago

Summary

Versions of Google Chrome and Debian Chromium older than 152.0.7977.65 can be tricked by a specially crafted web page to run code on your computer, bypassing the usual security sandbox. This could let an attacker take control of the affected system. Upgrade Chrome/Chromium to the latest release to protect against this risk.

What to do

Update google chrome to version 152.0.7977.65 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	chromium	All versions
–	google	chrome	< 152.0.7977.65
Debian:11	debian	chromium	All versions
Debian:12	debian	chromium	All versions
Debian:13	debian	chromium	All versions

Original advisory text

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

References

https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-79195 Vendor Advisory
https://issues.chromium.org/issues/501892500 Permissions Required

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published25 Aug 2026

Updated4 Nov 2026

First seen26 Aug 2026

Sources

DEBIAN-CVE-2026-79195 · OSV

CVE-2026-79195 · NVD

CVE-2026-79195 · MITRE

Track software like this

Free during beta