CVE-2026-79109

Improper input validation in Chrome’s printing functionality before version 152.0.7977.65 can allow a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox. The flaw, identified as a CWE‑20: Improper Input Validation, enables the potential for code execution with the privileges of the compromised renderer, bypassing Chrome’s usual sandbox protections. Chromium labels the severity of this issue as Medium, though the impact is consistent with a high‑severity vulnerability due to the remote code execution capability.

Google Chrome browsers on all desktop platforms (Windows, macOS, Linux) before the release of version 152.0.7977.65 are affected. The issue specifically relates to the rendering engine used in the printing path, meaning any user who visits a malicious page that initiates printing via the renderer could be exposed if a compromise occurs. Users running later versions of Chrome are not impacted.

With a CVSS score of 8.3, this flaw is considered high severity. The EPSS score of less than 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Despite these low metrics, the attack still requires a prior compromise of the renderer process. Once that compromise occurs, the attacker can execute code outside the browser sandbox, escalating to full system access. The absence of a public exploit or KEV entry suggests limited real-world exploitation so far, yet the potential impact remains high for environments with many Chrome users.