CVE-2026-79216: Google Chrome Heap Buffer Overflow in Blink

Blink is Chrome's rendering engine. A heap buffer overflow in Blink lets a page that has already compromised the renderer write past an allocation and corrupt adjacent heap data.

The CVSS vector notes high attack complexity, because the renderer must already be under attacker control. From there the overflow gives code execution inside the sandbox. Chromium rates it Medium; NVD scores it 7.5. Google fixed it in Chrome 152.0.7977.65 on 25 August 2026.