External risk intelligence

Chrome Use After Free Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79150

This vulnerability affects a client-side web browser. While it requires a remote attacker to provide a crafted HTML page, the browser itself is a client application, not an internet-facing service, gateway, or server-side component. Exploitation requires user interaction via the client, making it a client-side issue rather than a public-facing network service.

Use After Free

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Google Chrome allows remote attackers to execute code outside the sandbox through a malicious webpage. This issue, categorized as "use after free," could potentially lead to broader system compromise if exploited. The primary concern is confirming if our user base is affected and to what extent.

Flaw lets attackers run code remotely.
Browser vulnerability requires user interaction.
Confirm relevance and exposure of this issue.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then exploits a use-after-free vulnerability in Chrome's Views component. This could allow the attacker to execute code on the user's computer, potentially leading to a full system compromise.

Remote attacker requires user interaction.
Vulnerable component is a client-side browser feature.
Risk is arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome's Views component could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This could impact the confidentiality and integrity of the user's system.

System data and user data.
Visiting a malicious HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chrome's Views component requires immediate attention from teams responsible for endpoint security and application software management. The first practical step is to identify all Chrome installations within your environment, assess their exposure to potentially malicious HTML pages, and confirm their business criticality. Subsequently, owners of these Chrome instances should be identified to plan and coordinate remediation efforts.

Endpoint security and platform teams own this issue.
Verify Chrome installation reachability and business impact.
Plan and coordinate Chrome updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Chrome Views component affected by CVE-2026-79150?

Views is a core graphical user interface framework used by Google Chrome on macOS to render windows, dialogs, and widgets. It manages how interface elements are drawn and interact with the operating system. When this component contains errors, it can impact the stability and security of the entire browser process, as seen in this vulnerability.

What does a use-after-free weakness mean in this CVE?

A use-after-free, classified as CWE-416, happens when software continues to use a memory location after it has been cleared or deleted. An attacker can manipulate this state to replace that memory with malicious data, tricking the application into executing unauthorized code instead of the intended instructions, effectively hijacking the program's normal operations.

How does an attacker trigger CVE-2026-79150?

The vulnerability is triggered when a user visits a specially crafted, malicious HTML page. It does not trigger simply by having the browser open or by running background tasks. The attack requires active user navigation to a page designed to exploit the flaw in the Views component, meaning the browser's interaction with web content is the primary vehicle.

Is my device vulnerable according to Halo Surface Signal?

Halo Surface Signal notes this is a client-side issue, not a server-side service. Because Chrome is a browser, it is not an internet-facing gateway or server. While the bug allows remote code execution, it still requires a user to interact with a malicious page on their local client machine rather than attacking a persistent public-facing network service.

What are the first steps to address this Chrome vulnerability?

The most effective response is to identify all systems running older versions of Chrome on macOS and prioritize updating them to version 152.0.7977.65 or later. Focus on endpoints used by employees who frequently browse external web content, and coordinate with your internal teams to ensure these updates are deployed, as this directly patches the flaw in the Views component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.