External risk intelligence

Google Chrome Aura Use-After-Free Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79200

This vulnerability is located within the Google Chrome browser (Aura component) and requires a user to navigate to a crafted HTML page. As a client-side application, it is not a network service, gateway, or internet-facing infrastructure component reachable by remote attackers without direct user interaction, making typical public internet exposure for this specific attack surface very unlikely.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Google Chrome's Aura component that could allow a remote attacker to execute arbitrary code outside the sandbox through a malicious webpage. While the direct business impact requires confirmation, the core issue is a memory management flaw that, if exploited, could compromise user security within the browser environment. The primary concern at this stage is to determine the relevance and extent of exposure to our organization.

Browser flaw lets code run outside safe zone.
Critical bug could affect user data security.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website, which then exploits a use-after-free flaw in Chrome's Aura component. This could allow the attacker to execute code on the user's device, potentially leading to broader system compromise if other vulnerabilities can be chained.

Requires user to visit a malicious page.
Triggered by a use-after-free vulnerability.
Risks arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome's Aura component could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This could potentially impact the user's system by allowing unauthorized code execution.

User's system.
Via a malicious HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Google Chrome's Aura component allows remote code execution via a crafted HTML page. Identifying affected Chrome instances, confirming their external reachability, and then engaging with the Chrome update process or relevant application owners will be key.

Application owners should manage Chrome updates.
Verify external reachability of Chrome instances.
Plan remediation during planned maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Aura component?

Aura is the underlying UI framework within Google Chrome responsible for rendering the browser's interface, windows, and graphical elements. It manages how windows are displayed and how the browser interacts with the operating system's windowing capabilities. Because it handles complex visual processing, it must manage memory carefully to keep the browser environment stable.

What does the CWE-416 vulnerability mean for CVE-2026-79200?

CWE-416 refers to a 'Use After Free' memory error. This occurs when a program continues to use a memory address after that memory has been cleared or released. In the context of CVE-2026-79200, this creates a flaw in Chrome's Aura component where an attacker might manipulate that freed memory to inject and execute their own unauthorized code on the host device.

How is this Chrome vulnerability triggered?

The vulnerability is triggered when a user navigates to a specifically crafted HTML page designed to exploit the memory management flaw in Aura. It does not activate automatically; it requires the user to load malicious content. Simply having the browser installed or running without visiting such a page will not trigger this specific memory error.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for infrastructure components. Because this is a client-side browser vulnerability, it is not a network service or gateway that is inherently 'exposed' to the internet. Risk is primarily tied to end-user activity—specifically, the action of browsing to a malicious site—rather than direct remote targeting of your servers.

Do I need to update my browser to address this?

Yes. Since this is a browser-level vulnerability, the primary defense is updating Google Chrome to version 152.0.7977.65 or later. You should identify systems in your environment running older versions and ensure they are patched through your organization's standard update channels to eliminate the vulnerable Aura component code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.