CVE-2026-79216
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Medium)
Risk Assessment
An attacker could execute arbitrary code inside the sandbox, potentially leading to browser security compromise or further attacks.
Recommendation
Update Google Chrome to version 152.0.7977.65 or later.
Other vulnerabilities in Blink
See all- CVE-2016-5141High
Blink, as used in Google Chrome before version 52.0.2743.116, allows remote attackers to spoof the URL in the address bar via vectors involving a provisional URL for an initially empty document.
- CVE-2026-13959Medium
Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
- CVE-2026-13815High
A Use-After-Free vulnerability in the Blink component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The issue is rated as high severity.
Original NVD description (English source)
Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)