CVE-2026-78952: High Out of bounds write in Crashpad
Chromium: CVE-2026-78952 Out of bounds write in Crashpad
Other sources
Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.53 - Upgrade
Upgrade
Chromium/Google Chrome (Crashpad)to a version that resolves this vulnerability.Fixed in 152.0.7977.65 - Upgrade
Upgrade
Microsoft Edge (Chromium-based)to a version that resolves this vulnerability.Fixed in 152.0.7977.65
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which systems are affected?
The issue affects Google Chrome on Windows before version 152.0.7977.65. The provided information does not identify other operating systems as affected.
What must an attacker achieve to exploit this vulnerability?
An attacker must first compromise the renderer process. They can then use a crafted HTML page to trigger the out-of-bounds write and execute arbitrary code outside the Chrome sandbox.
What is the remediation?
Update Google Chrome on Windows to version 152.0.7977.65 or later.