Description
Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-25
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Memory Disclosure
Action: Apply Patch
AI Analysis

Impact

Improper state validation in the Performance component of Google Chrome allowed a remote attacker to read memory inside the sandbox environment through a crafted HTML page. This flaw can expose confidential data to an attacker and represents a high‑severity issue. The weakness is classified as CWE-754, improper use of a system resource or state.

Affected Systems

Google Chrome browser is affected. Versions of Chrome prior to 152.0.7977.65 are vulnerable. The issue arises specifically in the Performance module of the Chrome rendering engine.

Risk and Exploitability

The vulnerability is exploitable from a remote context by delivering a specially crafted HTML page to the victim’s browser, enabling memory disclosure within the sandbox. The CVSS score of 8.1 indicates high severity, and the EPSS score is below 1%, suggesting a low probability of exploitation. The flaw does not appear in the CISA KEV catalog, implying that publicly known, active exploits are not yet identified, but the potential impact warrants immediate attention.

Generated by OpenCVE AI on August 29, 2026 at 00:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 152.0.7977.65 or later.
  • Enable automatic browser updates to receive future patches promptly.
  • Verify that the sandbox feature remains enabled in any enterprise policy configuration that may alter default browser security settings.

Generated by OpenCVE AI on August 29, 2026 at 00:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Mon, 31 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Sat, 29 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Memory Read Vulnerability via Improper State Validation in Chrome

Fri, 28 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Memory Read Vulnerability via Improper State Validation in Chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-754
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-28T19:20:01.375Z

Reserved: 2026-08-25T06:08:35.195Z

Link: CVE-2026-79072

cve-icon Vulnrichment

Updated: 2026-08-28T19:18:05.295Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:02.920

Modified: 2026-08-31T16:54:39.710

Link: CVE-2026-79072

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:15:06Z

Weaknesses
  • CWE-754

    Improper Check for Unusual or Exceptional Conditions