CVE-2026-78952
published 2026-08-25CVE-2026-78952: Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to…
PriorityP349high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EPSS
0.40%
33.1th percentile
Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 152.0.7977.65 | 152.0.7977.65 | |
| chrome | >= 152.0.7977.65 < 152.0.7977.65 | 152.0.7977.65 | |
| chrome_desktop | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox v
ghsa_unreviewed·2026-08-25
CVE-2026-78952 CWE-787 Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox v
Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Chrome
Stable Channel Update for Desktop: CVE-2026-78952
vendor_chrome·2026-08-25
CVE-2026-78952 [HIGH] Stable Channel Update for Desktop: CVE-2026-78952
Stable Channel Update for Desktop
CVE-2026-78952: Out of bounds write in Crashpad. Reported by Brendan Dolan-Gavitt, XBOW on 2026-08-13 [TBD][ 546670199 ] High CVE-2026-79236: Type confusion in V8
Reported by Zhenpeng (Leo) Lin on 2026-08-14 [TBD][ 548340637 ] High CVE-2026-79078: Use after free in FedCM
Severity: high
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-78952 chromium-browser: Google Chrome Crashpad: Arbitrary code execution via out-of-bounds write
bugzilla·2026-08-25·CVSS 8.3
CVE-2026-78952 [HIGH] CVE-2026-78952 chromium-browser: Google Chrome Crashpad: Arbitrary code execution via out-of-bounds write
CVE-2026-78952 chromium-browser: Google Chrome Crashpad: Arbitrary code execution via out-of-bounds write
Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Hackernews
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
blogs_hackernews·2026-10-14
CVE-2026-85045 Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.
Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them , and paid XBOW its top $250,000 reward for a full Chrome exploit.
The attack is a full chain: a set of bugs used together to break every layer of Chrome's protection, f
2026-08-25
Published