CVE-2026-76034, CVE-2026-76036: Google Chrome — Remote Code Execution Risk (August 2026)

CVE-2026-76034, CVE-2026-76036 — Google Chrome

CVE-2026-76034 and CVE-2026-76036 are critical buffer overflow vulnerabilities in Google Chrome desktop, allowing remote attackers to execute arbitrary code outside the browser sandbox. No evidence of active exploitation has been reported, but the risk profile is severe due to the potential for full system compromise.

Attack Vector

Attackers can exploit these vulnerabilities by luring users to visit specially crafted HTML pages. The flaws enable a buffer overflow, which can bypass Chrome's sandbox protections and execute code on the underlying operating system. No user interaction beyond visiting a malicious site is required. Indicators of compromise are not yet published, but anomalous process launches from Chrome or unexpected outbound connections should be investigated.

Who Is at Risk

All organizations and users running Google Chrome desktop versions prior to the latest August 2026 security update are affected. Google is the primary impacted vendor, but the risk extends globally to any enterprise or individual using unpatched Chrome installations on Windows, macOS, or Linux.

Patch & Mitigate

• Patch: Update Chrome desktop to the latest version released August 2026. Apply immediately; Google has not provided a workaround.
• Workaround: None available—patch is mandatory.
• Detect: Monitor for unusual Chrome child processes, unexpected system-level activity initiated by Chrome, and traffic to suspicious domains following Chrome usage.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers use malicious HTML pages to gain initial foothold via browser exploitation.
• TA0005 — Defense Evasion: Exploiting buffer overflows to escape the Chrome sandbox and evade built-in browser protections.

Source: https://www.malwarebytes.com/blog/bugs/2026/08/update-chrome-now-two-critical-vulnerabilities-fixed