Search CVEs, research… / diras.sa
  • PoC PUBLIC
  • PATCH AVAILABLE

CVE-2026-78905: remote code execution in Google Chrome

An attacker can run arbitrary code in Google Chrome by inducing a type confusion in ANGLE when a user visits a specially crafted web page. CVE-2026-78905 affects Chrome 152.x builds prior to the fixed release 152.0.7977.65; the vendor lists 152.0.7977.65 as the fixed version. Exploitation requires user interaction (the victim must load the malicious page) and can lead to code execution outside the browser sandbox.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
8.8HIGH
EPSS
0.00451
CWE
CWE-843
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgently update affected Chrome installs because public exploit code exists for this ANGLE type confusion; applying the fixed build 152.0.7977.65 removes the vulnerability.

What is CVE-2026-78905?

An attacker can run arbitrary code in Google Chrome by inducing a type confusion in ANGLE when a user visits a specially crafted web page. CVE-2026-78905 affects Chrome 152.x builds prior to the fixed release 152.0.7977.65; the vendor lists 152.0.7977.65 as the fixed version. Exploitation requires user interaction (the victim must load the malicious page) and can lead to code execution outside the browser sandbox.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Which versions of Google Chrome are affected?

BRANCHAFFECTEDFIXED
152.x152.0.7977.65 – before 152.0.7977.65152.0.7977.65

Is CVE-2026-78905 being exploited?

Public exploit code is available.

How to fix CVE-2026-78905

  1. Upgrade Chrome to 152.0.7977.65 or later on all affected systems.
  2. Block or limit access to untrusted web content where possible and enforce safe browsing and content filtering.
  3. Monitor endpoints for signs of compromise and unusual child processes spawned by Chrome.
  4. Follow Google's security guidance and apply enterprise deployment policies to accelerate the update rollout.

Frequently asked questions

Is CVE-2026-78905 being actively exploited?

Public exploit code is available for CVE-2026-78905.

Which Chrome versions are affected by CVE-2026-78905?

Chrome 152.x builds before 152.0.7977.65 are affected; the vendor marks 152.0.7977.65 as the fixed version.

Is there a patch for CVE-2026-78905?

Yes. Google fixed the issue in Chrome version 152.0.7977.65.

Does CVE-2026-78905 require authentication?

No authentication is required, but exploitation requires user interaction: the victim must load a crafted web page in Chrome.

References