External risk intelligence

Google Chrome Aura Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79052

This vulnerability exists within the client-side browser engine. Successful exploitation requires a user to navigate to a crafted HTML page using the browser. It is not an internet-facing service, gateway, or network-accessible appliance that would be reachable by an attacker independently of user interaction.

Use After Free

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Aura component of Google Chrome, potentially allowing attackers to execute code outside the browser's security sandbox. This could be triggered by users visiting a specially crafted webpage. While the specific impact on our organization is still under analysis, the severity rating indicates a significant potential risk if our users are exposed.

A browser flaw allows code execution on user devices.
Critical severity requires vigilance and understanding.
Confirm relevance and assess potential user exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage to trigger this vulnerability. If successful, the attacker could potentially gain control of the user's system, allowing them to execute arbitrary code.

Requires user interaction with a malicious page.
Triggered by a crafted HTML page.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome's Aura component could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This could affect the confidentiality, integrity, and availability of the user's system and data.

User's system and data
User visits malicious HTML page
Arbitrary code execution outside sandbox

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability, a use-after-free flaw in the Aura component of Google Chrome, allows for remote code execution outside the sandbox via a malicious HTML page. Technical leaders and security teams should prioritize identifying all Chrome instances, especially those accessible to users who might encounter malicious web content. The first practical step involves confirming the reachability and business criticality of affected systems, identifying the accountable owners, and then planning remediation based on the assessed risk.

Own by the Google Chrome deployment team.
Verify user exposure to malicious web pages.
Plan Chrome updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Aura component in Google Chrome?

Aura is the underlying window management and graphics composition system used by Chrome. It handles how the browser draws its interface and renders content elements on the screen. Because it sits at such a fundamental level of the browser's architecture, vulnerabilities here can have significant security implications for the entire application.

What does a use-after-free vulnerability mean in CVE-2026-79052?

This is a memory management error categorized as CWE-416. It happens when software continues to use a memory address after it has been cleared or freed. If an attacker can manipulate this state, they may be able to force the browser to execute unintended code instead of safely crashing.

How is CVE-2026-79052 triggered?

An attacker triggers this by enticing a user to navigate to a specifically crafted HTML page. It does not activate automatically; it requires the user to interact with malicious web content. Simply having the browser installed or running in the background without visiting such a page will not trigger the vulnerability.

Is this CVE relevant to my internal servers?

According to Halo Surface Signal, this vulnerability is very unlikely to be an issue for servers because it exists within a client-side browser engine. It is not an internet-facing service or gateway that can be accessed remotely; the risk is primarily centered on end-user devices where employees browse the web.

What should I do if I manage Google Chrome deployments?

Your first step is to confirm that your Chrome installations are updated to version 152.0.7977.65 or later, which contains the fix. Coordinate with your deployment teams to verify the current versions in use across your organization and prioritize patching these endpoints to protect against code execution risks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.