External risk intelligence

Chrome Media Vulnerability Allows Remote Code Execution Outside Sandbox

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-78900

The vulnerability exists in a web browser, which is an application explicitly designed to fetch and render untrusted content from the public internet by default. Because it is a primary tool for internet navigation, it is constantly exposed to external web-based threats.

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves Google Chrome's media handling, where a flaw could allow attackers to execute malicious code. This type of issue in a widely used browser is a significant concern due to its potential to impact many users. The main concern is confirming if our environment is exposed to this type of threat.

Flaw lets bad code run if you visit a website.
Browser flaws can affect many users widely.
Verify exposure; understand technical impact.

Attack Path

How an attacker could exploit the issue

An attacker can entice a user to visit a specially crafted HTML page. When the user's browser processes this page, it incorrectly handles the input within the media component, potentially allowing the attacker to run their own code on the user's system, escaping the browser's security sandbox.

Requires a user to visit a malicious page.
Triggered by viewing malformed media content.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially execute arbitrary code outside the sandbox when a user visits a malicious HTML page using a vulnerable version of Google Chrome. This could affect the integrity and confidentiality of the system.

Arbitrary code execution in the browser.
Via a crafted HTML page.
System compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome requires immediate attention from teams responsible for end-user computing and browser management. The first critical step is to identify all Chrome instances, assess their reachability and business criticality, and then determine the appropriate ownership for remediation, likely involving desktop support or application administrators.

Identify Chrome instances; confirm exposure.
Verify user impact and criticality.
Plan and coordinate browser updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and its Media component?

Google Chrome is a web browser built on the Chromium open-source project, used globally to access and render internet content. The Media component within Chrome handles the processing of audio and video streams, ensuring that various multimedia formats displayed on websites can be played back within the browser's environment.

What does CWE-20 mean for CVE-2026-78900?

CWE-20 refers to Improper Input Validation. In the context of CVE-2026-78900, this means the Media component fails to correctly verify or sanitize the data it receives from a website. Because this validation is missing, the browser may process malformed or unexpected data in a way that allows malicious instructions to execute.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by creating a specially crafted HTML page containing malicious media content. When a user visits this page, the browser attempts to process the invalid media, leading to the security failure. Simply having Chrome installed is not enough; the user must actively navigate to the malicious site for the trigger to occur.

Why is this CVE considered relevant to my environment?

According to Halo Surface Signal, this vulnerability is highly relevant because web browsers are designed to fetch and render untrusted content from the public internet. Since Chrome is a primary tool for navigation, it is constantly interacting with external web-based threats, making the browser a direct point of exposure.

How do I address CVE-2026-78900 in my organization?

The primary response is to ensure all Chrome instances are updated to version 152.0.7977.65 or later, which resolves the input validation error. You should coordinate with your IT or desktop management teams to identify vulnerable installations and prioritize the deployment of the latest browser update to all managed endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.