CVE-2026-78909: Use After Free

Q: What does an attacker need to exploit this issue?

The attacker must convince a user to interact with a crafted HTML page. Successful exploitation can lead to arbitrary code execution outside the Chrome sandbox.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.65 are affected.

Q: How can exposure be reduced if an update cannot be deployed immediately?

Reduce users' exposure to untrusted or attacker-supplied web pages and reinforce protections against social-engineering attempts, since exploitation requires user interaction with a crafted HTML page.

Published Aug 25, 2026

Updated

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<152.0.7977.65

Event History

Aug 25, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must convince a user to interact with a crafted HTML page. Successful exploitation can lead to arbitrary code execution outside the Chrome sandbox.

Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.65 are affected.

How can exposure be reduced if an update cannot be deployed immediately?

Reduce users' exposure to untrusted or attacker-supplied web pages and reinforce protections against social-engineering attempts, since exploitation requires user interaction with a crafted HTML page.

CVE-2026-78909: Use After Free

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Chrome versions are affected?

How can exposure be reduced if an update cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Chrome versions are affected?

How can exposure be reduced if an update cannot be deployed immediately?