CVE-2026-78952: Google Chrome Sandbox Escape via Out-of-Bounds Write in Crashpad

Crashpad is the crash reporting handler that runs beside Chrome. On Windows it accepts data from the renderer process across the sandbox boundary without enough bounds checking.

An attacker who already controls a renderer sends malformed data to Crashpad and writes past a buffer in the handler. Because Crashpad runs outside the sandbox, the result is code execution outside the sandbox. Chromium rates it High; NVD scores it 8.3. Google fixed it in Chrome 152.0.7977.65 on 25 August 2026.