Critical RCE Vulnerabilities in Chrome (CVE‑2026‑79282, CVE‑2026‑78899) Prompt Immediate Update
What Happened — Google released Chrome 152.0.7977.64/65 with 327 security fixes, including ten critical flaws. Two highlighted CVEs (CVE‑2026‑79282 in ANGLE and CVE‑2026‑78899 in the V8 engine) allow remote code execution via a malicious web page, potentially bypassing the browser sandbox.
Why It Matters for Compliance & Audit Readiness
- Unpatched browsers constitute a control gap in the Change Management and System Operations criteria of SOC 2 (CC6.1, CC7.1).
- Demonstrating timely patching requires continuous evidence collection and mapping of patch‑management controls to audit requirements.
- Verisq’s Control Mapping capability lets you capture, correlate, and report patch‑status data as immutable audit evidence.
Who Is Affected — All organizations that permit end‑user browsing on Windows, macOS, or Linux—spanning finance, healthcare, SaaS, retail, and government sectors.
Recommended Actions
- Verify that Chrome is updated to version 152.0.7977.64 (or later) across all endpoints.
- Integrate browser‑patch status into your configuration‑management database (CMDB) and automate daily compliance checks.
- Map the patch‑management process to SOC 2 change‑control controls and retain evidence in a centralized Trust Center.
Technical Notes
- CVE‑2026‑79282 (ANGLE): Remote code execution outside the sandbox via crafted HTML.
- CVE‑2026‑78899 (V8 use‑after‑free): CVSS 8.8, arbitrary code execution inside the sandbox; may be chained to escape.
- Both vulnerabilities are exploitable simply by visiting a malicious site; no user interaction beyond browsing is required.
Source: Malwarebytes Labs – Update Chrome before you browse again