CVE-2026-79078 in Chrome
Summary
by MITRE • 08/26/2026
Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-8389 represents a critical memory corruption flaw within the FedCM component of Google Chrome, specifically affecting versions prior to 152.0.7977.65. This issue is classified under CWE-416, Use After Free, which describes a scenario where software continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by attackers. In the context of Chrome's architecture, FedCM handles identity management and authentication flows, making its integrity paramount for user security. The root cause lies in improper memory management during the lifecycle of objects associated with these identity protocols, where resources are deallocated but references to those resources remain active within the execution context.
From a technical perspective, this use-after-free condition allows an attacker who can craft and deliver a malicious HTML page to trigger the premature release of memory while other parts of the browser still hold valid pointers to that same memory region. When the application subsequently attempts to access or modify data through these stale pointers, it operates on freed heap memory. This manipulation enables arbitrary code execution because the attacker can control the contents of the freed memory block, often by allocating new objects with specific structures that mimic legitimate system objects. By carefully crafting the payload within this allocated space, the attacker can overwrite function pointers or object vtables, thereby redirecting program flow to execute malicious shellcode outside the browser's sandbox environment.
The operational impact of this vulnerability is severe due to its potential for remote code execution via social engineering. An adversary does not need direct network access to a vulnerable system but rather relies on tricking a user into visiting a specially crafted webpage, typically through phishing campaigns or drive-by downloads. Once executed, the malicious code runs with the privileges of the current user, potentially allowing full compromise of the host machine. This bypasses Chrome's sandbox protections, which are designed to limit the damage caused by exploits within the browser process. The severity rating of High reflects both the ease of exploitation through standard web technologies and the significant security implications of escaping the sandbox boundary.
This incident aligns with MITRE ATT&CK technique T1203, Exploitation for Client Execution, where attackers use client-side software vulnerabilities to execute malicious code on a victim's system. It also relates to T1059, Command and Scripting Interpreter, as the initial execution often leads to further scripting activities that establish persistence or move laterally within a network. The vulnerability underscores the importance of rigorous memory safety practices in complex web browsers, particularly in components handling sensitive identity data like FedCM.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 152.0.7977.65 or later immediately upon availability. Patch management processes should be optimized to prioritize security updates for browser software due to their high exposure surface area. Additionally, users should exercise caution when interacting with unfamiliar web content and utilize email filtering and endpoint detection solutions that can identify indicators of compromise associated with drive-by download attacks. Regular auditing of browser configurations and disabling unnecessary plugins or extensions can further reduce the attack surface available to potential exploiters targeting memory corruption flaws in identity management components.