CVE-2026-79071

Executive Summary

CVE-2026-79071 describes a race condition in Google Chrome's GPU component, present in versions prior to 152.0.7977.65. The vulnerability allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox and execute arbitrary code on the host system via a crafted HTML page. The Chromium security team has rated this issue as Medium severity. Patch availability is claimed by a single source (NVD) but has not been independently confirmed; no public exploitation evidence, PoC, or CVSS scoring has been published at the time of this report.

Technical Analysis

CVE-2026-79071 is a race condition vulnerability (CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition) residing in the GPU component of Google Chrome. The NVD description indicates that the flaw is triggerable when a remote attacker, who has already achieved code execution within the renderer process, delivers a crafted HTML page to the victim.

The vulnerability class — TOCTOU race condition — involves a window between the time a resource is checked and the time it is used. In the context of a GPU subsystem in a browser, this typically involves shared memory buffers, command buffer validation, or resource state transitions. An attacker controlling the renderer could race a security check against a state mutation, causing the GPU process to operate on resources that no longer match the validated state, leading to memory corruption or type confusion.

The attack surface is the GPU process — a high-privilege, sandboxed-but-separate process in Chrome's architecture that handles graphics operations. Because the GPU process runs outside the renderer sandbox, successful code execution there can lead to full sandbox escape. The NVD description explicitly states the impact as "execute arbitrary code outside the sandbox."

Available technical detail is limited. The NVD description does not specify the exact function names, specific GPU APIs involved, or the precise race condition mechanism. No additional CNA information, vendor advisory details, or researcher analysis is available at the time of writing. It is reasonable to note that GPU command buffer processing and shared memory synchronization are common locations for such races in Chromium.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Specific implementation details beyond the description are not known and are not fabricated here.

Step 1 — Reconnaissance & Target Identification: An attacker identifies targets running Chrome versions prior to 152.0.7977.65. These would include enterprise users on managed Chrome deployments, kiosk systems, or personal workstations. The attacker also needs a method to compromise the renderer process first, per the NVD description's premise ("remote attacker who had compromised the renderer process"). This prior compromise could be achieved via a separate renderer RCE, a malicious web page exploiting a different vulnerability, or a compromised extension.

Step 2 — Triggering the Race: The attacker crafts an HTML page containing JavaScript and WebGL/GPU API calls designed to interact with the GPU subsystem in a way that induces a race condition. The page would need to repeatedly call GPU operations while concurrently mutating state — for example, issuing commands that reference shared buffers while another thread reallocates or frees those buffers. The precise API sequences are unknown from the description.

Step 3 — Payload Execution: At the vulnerability-class level, successfully winning the race allows the attacker to cause the GPU process to read or write memory beyond validated bounds, or to misinterpret a type, leading to arbitrary memory corruption. From there, the attacker crafts a payload that redirects execution flow to shellcode or ROP chain, achieving arbitrary code execution within the GPU process.

Step 4 — Post-Exploitation: Since the GPU process runs outside the renderer sandbox, code execution there effectively constitutes a sandbox escape. The attacker can then leverage this access to read/write process memory, access system resources, or chain further local privilege escalation techniques to gain broader system control. Full impact would be arbitrary code execution on the host, potentially leading to data exfiltration, persistence, or lateral movement within an enterprise network.

Note: As the renderer compromise is a prerequisite, this CVE is best understood as a second-stage sandbox-escape primitive rather than a standalone initial access vector.

Impact Assessment

• Confidentiality: HIGH — Arbitrary code execution outside the sandbox enables reading of sensitive data from the host, including credentials, files, and other process memory.
• Integrity: HIGH — An attacker can modify system files, install malware, or alter the Chrome installation itself.
• Availability: HIGH — An attacker can terminate system processes, render systems inoperable, or deploy ransomware.

Blast Radius: All Chrome users below version 152.0.7977.65 are affected. This includes enterprises relying on Chrome as a primary browser, CI/CD systems using headless Chrome, and embedded Chromium-based applications. The medium severity rating (per Chromium) reflects the prerequisite renderer compromise; however, the actual post-exploitation impact is full system compromise, which is high severity from an enterprise perspective.

Business Impact:

• For enterprises: unauthorized access to corporate data, potential breach notification obligations, and lateral movement risk.
• The prerequisite renderer compromise suggests that attackers already needed an initial foothold; however, chaining this CVE with even a low-severity renderer bug raises the combined impact to critical.

Detection Guidance

Detection is challenging because this is a race condition in a GPU component triggered by crafted HTML content. Network-level detection may be limited. Focus should be on post-exploitation behavior and process anomalies.

Sigma Rule

title: Chrome GPU Process Memory Corruption Indicator
id: 06a43c3a-9d55-4b1e-b41a-3f692c34f1a7
status: experimental
description: Detects abnormal Chrome GPU process behavior indicative of exploitation of CVE-2026-79071
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-79071
author: Valtersit Threat Intel Team
date: 2026/05/01
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.79071
logsource:
    category: process_creation
    product: windows
detection:
    selection_gpu_crash:
        Image|endswith: '\chrome.exe'
        CommandLine|contains|all:
            - '--type=gpu-process'
        # Common crash signatures for memory corruption
        Description|contains:
            - 'STATUS_ACCESS_VIOLATION'
            - 'STATUS_HEAP_CORRUPTION'
            - 'STATUS_STACK_BUFFER_OVERRUN'
    selection_rapid_restart:
        # Multiple GPU process starts within a short window
        Image|endswith: '\chrome.exe'
        CommandLine|contains: '--type=gpu-process'
    condition: selection_gpu_crash
    timeframe: 5m
level: high
falsepositives:
    - GPU driver crashes unrelated to this CVE
    - Hardware acceleration issues on older GPUs

YARA Rule

rule CVE_2026_79071_Chrome_GPU_Race
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious HTML/JS patterns potentially used to trigger CVE-2026-79071 GPU race condition"
        date = "2026-05-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79071"
        severity = "medium"
    strings:
        // Generic WebGL/GPU API calls and race-triggering loop patterns
        $webgl1 = "getUniformLocation" ascii nocase
        $webgl2 = "bufferSubData" ascii nocase
        $webgl3 = "texImage2D" ascii nocase
        $webgl4 = "createBuffer" ascii nocase
        $race = "performance.now()" ascii
        $loop1 = "requestAnimationFrame" ascii nocase
        $loop2 = "setInterval" ascii nocase
    condition:
        3 of ($webgl*) and 1 of ($race, $loop1, $loop2) and filesize < 5MB
}

Note: This rule detects the generic vulnerability class pattern (WebGL interaction with timing loops). It is not specific to this CVE due to lack of published specifics.

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-79071 Potential Chrome GPU Race Exploit HTML Delivery";
    flow:to_client,established;
    content:"text/html"; http.content_type;
    pcre:"/(getUniformLocation|bufferSubData|texImage2D).{0,500}(requestAnimationFrame|setInterval)/si";
    sid:7907101;
    rev:1;
    metadata:created_at 2026_05_01, updated_at 2026_05_01;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79071;
)

Note: Network detection is unreliable for this vector since the exploit is delivered as benign-looking JavaScript. This rule only flags obvious combinations.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and
   process.name == "chrome.exe" and
   process.command_line contains "--type=gpu-process"]
  [process where event.action == "end" and
   process.name == "chrome.exe" and
   process.command_line contains "--type=gpu-process" and
   process.exit_code != 0]

Note: Detection is based on repeated GPU process crashes, which may indicate exploitation attempts.

Splunk SPL Query

index=windows sourcetype=WinEventLog:Application
| search "chrome.exe"
| rex field=Message "(?<exception_code>0x[0-9a-fA-F]+)"
| where exception_code IN ("0xC0000005", "0xC0000374", "0xC0000409")  // ACCESS_VIOLATION, HEAP_CORRUPTION, STACK_BUFFER_OVERRUN
| stats count by host, _time
| where count > 3
| table _time, host, count
| sort - _time

Note: Repeated access violations in chrome.exe may indicate exploitation attempts.

Wazuh OSSEC Rule

<group name="chrome,gpu,exploitation,">
  <rule id="790710" level="12">
    <if_sid>5715</if_sid>
    <match>chrome.exe</match>
    <regex>--type=gpu-process</regex>
    <description>CVE-2026-79071: Repeated Chrome GPU process crashes detected, possible exploitation attempt</description>
    <group>local_policy,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The fix is claimed by a single source (NVD) but is not independently confirmed. The vendor (Google) has not been verified as acknowledging this specific CVE, and the patch version 152.0.7977.65 is stated but not cross-referenced in any vendor advisory.

1) Immediate Mitigations (until patch is verified):

• Restrict WebGL usage: Disable hardware acceleration in Chrome enterprise policy via the HardwareAccelerationModeEnabled policy set to false.
• Application allowlisting: Implement application control (e.g., AppLocker, Microsoft Defender Application Control) to prevent untrusted DLL injection into chrome.exe.
• Sandbox reinforcement: Ensure Chrome's sandbox is fully operational; do not run Chrome with --no-sandbox under any circumstances.
• Network segmentation: Since the attack requires a prior renderer compromise, reduce the attack surface for all renderer-facing vulnerabilities by blocking malicious web content and enforcing extension allowlists.
• Monitor GPU process crashes with the detection rules above for early warning.

2) Patch/Upgrade Steps:

• Verify the patch detail: Check Google Chrome Releases blog (https://chromereleases.googleblog.com) for the stable channel update containing 152.0.7977.65.
• If verified, push the update via enterprise software management tools (GPO, Jamf, SCCM, or Chrome Enterprise management console).
• Important caveat: Ensure the update is from the official Google release channel; verify the SHA-256 hash of the installer.
• Roll out to a pilot group first, then broadly deploy.

3) Long-Term Hardening:

• Maintain latest Chrome versions with a defined upgrade SLA (e.g., within 7 days of stable release for browsers in use on corporate endpoints).
• Enable Chrome enterprise policies for automatic updates and disable legacy browser versions.
• Consider risk-based patching: Prioritize endpoints with elevated privileges or sensitive data access for faster patching cycles.
• Layer defense: Run browser isolation for untrusted web content, or use Virtualized AppLocker with Chrome in a remote sandbox environment (e.g., Citrix or VDI) for high-risk users.

References

1. NVD Entry — CVE-2026-79071: https://nvd.nist.gov/vuln/detail/CVE-2026-79071
2. Google Chrome Releases (verify patch version): https://chromereleases.googleblog.com
3. CWE-367 (TOCTOU Race Condition): https://cwe.mitre.org/data/definitions/367.html
4. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to this CVE. No evidence of exploitation in the wild has been published. The exploitability status remains unconfirmed due to lack of technical details and PoC code. CISA has not listed this CVE in KEV (Known Exploited Vulnerabilities) catalog as of the report date. Enterprises should nevertheless prioritize patching due to the high post-exploitation impact (sandbox escape leading to RCE).