CVE-2026-79132

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Description
Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

Improper input validation in Google Chrome on Android prior to 152.0.7977.65 allows an attacker who has already compromised the renderer process to craft a malicious HTML page that can escape the sandbox and execute arbitrary code. This vulnerability is a CWE‑20 flaw and can give the attacker full device control, leading to data theft, malware installation, or further exploitation.

Affected Systems

Android versions of Google Chrome older than 152.0.7977.65 are affected. Users running any earlier Chrome release on Android devices face this risk and should upgrade to the latest stable channel.

Risk and Exploitability

The CVSS score of 8.3 signals high severity. EPSS score is <1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. Nevertheless, once a renderer‑process compromise is achieved—such as via a malicious web page—the sandbox escape can be leveraged to execute code outside the browser sandbox.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store or system update mechanism.
  • If upgrading is not immediately possible, configure Chrome Enterprise policies or use device management to restrict untrusted content, disable unsafe renderer extensions, and enable safe browsing to mitigate the risk of renderer compromise.
  • As a temporary measure, avoid visiting untrusted or unknown websites, disable JavaScript or WebAssembly where possible, and use a reputable VPN or DNS filtering service to reduce the likelihood of malicious input reaching the renderer.

Generated by OpenCVE AI on August 26, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References
Weaknesses
  • CWE-20

    Improper Input Validation

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:57 AM
Reserved
Aug 25, 2026, 6:10 AM

View source JSON

Updated
Aug 26, 2026, 2:52 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 27, 2026, 12:53 PM

View source JSON

No data.

Updated
Aug 26, 2026, 5:30 PM

JSON