CVE-2026-84324

Google Chrome versions prior to 152.0.7977.75 contain a use-after-free (CWE-416) in the Proxy component of the browser's network stack. A remote attacker can trigger the flaw using crafted network traffic, requiring no user interaction, although the conditions for successful exploitation are complex (CVSS AC:H). If exploited, the bug yields arbitrary code execution outside Chrome's security sandbox, giving the attacker OS-user-level privileges on the victim machine rather than a contained in-browser compromise. All Chrome users on affected builds are in scope, and organizations running Chromium-based browsers that bundle Chrome's network code may also be exposed, though only Chrome is named in the advisory. As of publication the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates just a 0.3% chance of exploitation in the next 30 days, so no exploitation has been observed.

What to do: Update Google Chrome to 152.0.7977.75 or later and verify the running version in chrome://version rather than assuming auto-update has fired, prioritizing internet-reachable browsing hosts and high-value users; there are no known workarounds since the trigger is network traffic. Administrators of Chromium-based browsers should confirm with their vendor whether the underlying Chromium fix has been incorporated into their builds.