CVE-2026-79236Active Exploitation(google / chrome)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch google chrome systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

4.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-843

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
Products
chrome

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-01: 1Active Exploitation · 2026-09-01: 1Patch / Workaround · 2026-09-01: 1Technical Details · 2026-09-01: 109-01
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Taha ז@lordx64
    Active Exploitation

    The last Chrome Browser CVE-2026-79236 Type Confusion in V8 exploited in less than < 24h by CyberKimi Told you, it will be exponentially difficult to catch up with CyberKimi when it comes to cyber ops, the RL rollouts are finally paying off. Now we autonomously exploited CVE-2026-79236 using CyberKimi, in less than 24h with our special Chrome exploit harness that chained 3 other bugs. I’m expecting this 24h buffer to shrink over RL rollouts. The full chain, no human wrote a line: → Our exploit harness patch-diff pipeline flags the V8 fix the day it ships → root-caused the homomorphic-IC wild write → chained 3 n-days: wild write → in-cage R/W → V8 sandbox escape → PC control (arm64 RegExp calling-convention bug) → PAC-safe JOP chain → system(), calc pops, V8CTF flag read, pure JS in the renderer. → target: Chromium 152.0.7977.60, M152 stable (Aug 25 2026), arm64 → reliability: 10/10 consecutive runs the exploit is of course not public, contact me contact@adverserial.ai if you want to know more and make sure to update your Chrome browser asap. I agree, the stuff that @DarioAmodei and @sama warned you about, is actually CyberKimi🐺 We are crafting exploit payload tokens on hard targets - join us, get into the waitlist: https://adverserial.ai/waitlist oh and CyberKimi is coming back very soon🐺 Chrome release: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html

    Post summary

    The post claims that CVE‑2026‑79236 in Chrome was actively exploited within 24 hours by CyberKimi using a proprietary harness, and stresses an urgent update to mitigate the threat.

    41901197710.2K
    9.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgooglechrome---

Explore more