CVE-2026-79069

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

Chrome’s Tint component on macOS suffers from a memory‑corruption flaw that can be triggered by a crafted HTML page. The resulting buffer misuse permits a remote attacker to break out of the sandbox and run code with system privileges. This vulnerability falls under CWE‑119, highlighting improper handling of memory buffers.

Affected Systems

Google Chrome for macOS versions prior to 152.0.7977.65 are affected. Users of the stable channel on Mac computers must verify they are running a later release, as earlier versions contain the Tint flaw.

Risk and Exploitability

The flaw has a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1%, suggesting a low but nonzero probability of exploitation. Attackers would need network or user interaction to supply the malicious HTML—such as hosting a crafted web page or delivering a file via email. Once delivered, the experience is essentially remote code execution, making this a high‑risk vulnerability if unpatched. The vulnerability is not listed in CISA’s KEV catalog and no exploitation evidence has been reported.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 152.0.7977.65 or newer as soon as possible; this version resolves the Tint memory‑corruption bug.
  • Keep the Chrome auto‑update feature enabled so future security patches are applied automatically.
  • Avoid opening or viewing untrusted web pages or HTML content that may contain malicious scripts; consider restricting such content through browser settings or network controls.

Generated by OpenCVE AI on August 26, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Memory Corruption in Chrome Tint Enables Remote Code Execution
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Memory Corruption in Chrome Tint Enables Remote Code Execution
Type Values Removed Values Added
Description Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-119
References
Earlier changes (2)
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:58 AM
Reserved
Aug 25, 2026, 6:08 AM

View source JSON

Updated
Aug 26, 2026, 4:35 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 27, 2026, 4:17 AM

View source JSON

No data.

Updated
Aug 26, 2026, 8:45 PM

JSON