External risk intelligence

Chrome Use After Free in Views Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79128

This vulnerability exists within a web browser client. While it requires the user to process crafted content, the browser itself is a client-side application, not a public-facing server, service, or network edge appliance. It does not provide an externally reachable management surface or protocol service, making it unlikely to be deployed as an internet-facing service.

Use After Free

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in Google Chrome's Views component could allow a remote attacker to execute arbitrary code. This issue has been addressed in a recent update to the browser.

A browser flaw allows code execution.
Users could be targeted via malicious websites.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can entice a user to visit a malicious web page, which then targets a use-after-free vulnerability within Chrome's Views component. Successfully triggering this vulnerability could allow an attacker to execute arbitrary code outside the browser's sandbox.

Requires user to visit a crafted HTML page.
Vulnerability in Chrome's Views component.
Risk of code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome's Views component could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a crafted HTML page.

Arbitrary code execution in the browser.
Visiting a malicious HTML page.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome on macOS, specifically affecting its rendering of crafted HTML pages. The initial step for any organization is to identify all instances of the affected Chrome version across their macOS fleet. Once identified, confirm which systems are business-critical and determine the accountable owner for these endpoints, whether it be an endpoint management team, a platform team, or individual asset owners, before planning remediation.

Endpoint owners should coordinate remediation.
Verify Chrome is the current version.
Plan for controlled updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Views component?

Views is the graphical user interface framework used by Google Chrome to render elements like buttons, menus, and the browser window itself. It handles how these visual components are created and destroyed during a browsing session. This vulnerability specifically affects how the browser manages the memory associated with these interface elements on macOS.

What does a use-after-free vulnerability mean in CVE-2026-79128?

This is a memory management flaw categorized as CWE-416. It occurs when a program continues to use a memory address after it has been cleared or freed. An attacker can exploit this by replacing the original data in that memory space with their own malicious instructions, which the browser then inadvertently executes.

How does an attacker trigger this vulnerability?

The trigger requires a user to navigate to a specifically crafted HTML page designed to interact with the vulnerable Views component. Simply having the browser open or running in the background does not trigger the bug; the browser must actively parse the malicious content for the memory error to occur.

Is my machine at risk if Chrome is not an internet-facing server?

According to Halo Surface Signal, this vulnerability is considered unlikely to be found on internet-facing servers because Chrome is a client-side application. The primary risk is to individual end-user workstations. Because the browser is not a network-edge appliance, the threat depends entirely on user activity rather than direct network accessibility.

Do I need to update my software to fix this?

Yes. The first step is to identify all macOS endpoints running versions of Chrome older than 152.0.7977.65. Once you have a list of these systems, coordinate with your endpoint or IT team to ensure the browser is updated to the latest version to patch the memory flaw and restore standard sandbox protections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.