Description
Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Published: 2026-08-25
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the Chromoting component of Google Chrome for Windows. The vulnerability allows a remote attacker to craft network traffic that causes the browser to execute code outside its sandbox, giving the attacker full control of the affected system. The weakness is a classic memory‑management error, classified as CWE‑416.

Affected Systems

Google Chrome versions on Windows prior to 152.0.7977.65 contain the bug. Systems running the affected releases are at risk when the Chromoting component is reachable via external traffic.

Risk and Exploitability

The flaw can be exploited remotely without local user interaction or elevated privileges. The CVSS score of 8.1 indicates high severity, while an EPSS score of < 1 % shows a very low likelihood of wild exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Any device that hosts the vulnerable Chrome release and allows inbound traffic can be targeted.

Generated by OpenCVE AI on August 26, 2026 at 21:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 152.0.7977.65 or later, which removes the Chromoting use‑after‑free bug.
  • If an update cannot be performed immediately, disable the Chromoting or remote‑desktop feature in Chrome to block the vulnerable network traffic.
  • Apply network‑level filtering or monitoring to detect unusual connections to Chrome until the software is updated, and keep the operating system and other security patches current.

Generated by OpenCVE AI on August 26, 2026 at 21:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Wed, 26 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Use After Free in Chromoting Leading to Remote Code Execution

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 26 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Use After Free in Chromoting Leading to Remote Code Execution

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:57:42.885Z

Reserved: 2026-08-25T06:11:13.725Z

Link: CVE-2026-79194

cve-icon Vulnrichment

Updated: 2026-08-26T16:05:01.431Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:13.140

Modified: 2026-08-27T13:50:46.037

Link: CVE-2026-79194

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T21:45:03Z

Weaknesses