External risk intelligence

Google Chrome FileSystem Incorrect Reference Resolution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-78985

The vulnerability exists in a web browser, which is a client-side application designed to interact directly with the public internet by processing arbitrary HTML content from remote web servers. Common deployment involves frequent exposure to untrusted network traffic during standard web browsing activities.

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue was found in Google Chrome that could allow an attacker to execute code outside the browser's secure environment. This could happen if a user visits a specially crafted webpage.

Issue: Code execution outside the browser sandbox.
Why remember: Affects widely used web browser technology.
Executive takeaway: Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which would then leverage a flaw in how Chrome handles file paths. This could allow them to execute code on the user's device, potentially bypassing security measures.

Requires visiting a malicious website.
Triggered by a crafted HTML page.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could leverage social engineering to trick a user into visiting a crafted HTML page, potentially leading to arbitrary code execution outside the browser sandbox. This could impact the confidentiality, integrity, and availability of the system when supported by the advisory.

System data and user data could be affected.
Exploitation via a crafted HTML page.
Arbitrary code execution outside the sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's FileSystem component, allowing for potential arbitrary code execution outside the sandbox via a crafted HTML page, requires swift action from teams managing end-user computing environments. The immediate first step is to identify all Chrome instances, assess their exposure and criticality, and locate the owners responsible for these endpoints to coordinate remediation.

Endpoint owners should manage this issue.
Verify Chrome browser reachability and usage.
Plan coordinated user communication and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Chrome FileSystem component?

The FileSystem component in Google Chrome is a framework that allows web applications to interact with a sandboxed section of the local file system. It enables browser-based tools, like offline editors or complex web apps, to read and write files directly on the user's device while maintaining security boundaries between the web content and the operating system.

What does incorrect reference resolution mean for CVE-2026-78985?

This vulnerability, classified as CWE-706, means the browser fails to correctly manage or validate links to file paths. Because the browser misinterprets these references, it can be tricked into performing actions on files it should not access, effectively breaking the 'sandbox'—the security layer meant to contain web content and prevent it from affecting the rest of your computer.

How is this Chrome vulnerability triggered?

This issue is triggered when a user is convinced to navigate to a specifically crafted HTML page designed to exploit the faulty path resolution. Simply opening the browser or visiting legitimate websites does not trigger the bug; it requires active interaction with malicious content that leverages this specific flaw to bypass existing security controls.

Why is this vulnerability relevant to me?

According to Halo Surface Signal, this vulnerability is highly relevant because Google Chrome is a client-side application built specifically to process untrusted content from the public internet. Since the browser is constantly handling external data, any device running an outdated version of Chrome is potentially exposed to this risk during routine web activity.

Do I need to update my software to fix this?

Yes, the primary response is to ensure your Chrome browser is updated to version 152.0.7977.65 or later. You should verify your current version, identify all endpoints in your environment where Chrome is installed, and prioritize the rollout of this update to ensure all users are protected against the potential sandbox escape.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.