CVE-2026-78893: Google Chrome QUIC Information Disclosure

CVE-2026-78893 Overview

CVE-2026-78893 is an information disclosure vulnerability in the QUIC transport protocol implementation in Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to leak sensitive information through a crafted HTML page. The Chromium project classifies the security severity as Medium. Exploitation requires user interaction, such as visiting an attacker-controlled website. The weakness is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
A remote attacker can leak sensitive information from the browser by luring a user to a crafted HTML page that abuses Chrome's QUIC implementation.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the affected QUIC stack
Desktop Stable channel builds distributed before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-78893 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78893

Vulnerability Analysis

The flaw resides in Chrome's QUIC (Quick UDP Internet Connections) implementation, the transport protocol underpinning HTTP/3. A crafted HTML page can trigger conditions in the QUIC stack that expose sensitive information to a remote origin. The disclosed data can include state that should remain isolated to the browser process or to another origin. Google has not published exploitation specifics, following Chromium disclosure policy that restricts issue tracker access until patch adoption stabilizes.

The issue is tracked internally as Chromium Issue 495998981 and resolved in the Stable channel update announced on the Chrome Releases blog.

Root Cause

The root cause is an information exposure weakness [CWE-200] within QUIC session handling. Improper isolation or unintended readback of transport-layer state allows a remote endpoint to observe data it should not receive. Because QUIC multiplexes streams and manages connection state in user space, subtle logic errors in state accounting can surface protected information to attacker-controlled peers.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a crafted HTML page that initiates QUIC traffic to an attacker-controlled server or manipulates the client-side QUIC session. When the victim visits the page, the browser processes the malicious content and leaks sensitive information back to the attacker. No authentication or elevated privileges are required.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker entry for the vendor-maintained technical record.

Detection Methods for CVE-2026-78893

Indicators of Compromise

Outbound UDP/443 (QUIC) sessions from browser processes to newly registered or low-reputation domains immediately after page navigation
Web proxy or DNS logs showing user visits to unfamiliar HTML content followed by sustained QUIC connections
Endpoint telemetry indicating Chrome versions earlier than 152.0.7977.65 in the environment

Detection Strategies

Inventory installed browser versions and flag hosts still running Chrome builds prior to 152.0.7977.65
Correlate browsing telemetry with threat intelligence feeds to surface visits to suspicious pages that initiate QUIC traffic
Use network monitoring capable of parsing QUIC metadata to identify anomalous session patterns from browser clients

Monitoring Recommendations

Track Chrome update compliance across managed endpoints using enterprise policy or endpoint management tools
Alert on new outbound QUIC destinations following user-initiated navigation events
Review web gateway logs for repeated visits to previously unseen domains serving HTML that establishes QUIC sessions

How to Mitigate CVE-2026-78893

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart the browser after the update installs to complete the patch process
Verify Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google released the fix in the Stable channel update announced on August 25, 2026. Users should upgrade to Chrome 152.0.7977.65 or later. Refer to the Google Chrome Stable Update announcement for release notes and distribution details.

Workarounds

Disable QUIC in Chrome via the QuicAllowed enterprise policy set to false until the update is deployed
Restrict user access to untrusted web content through web gateway policies and URL filtering
Force browser updates through group policy or mobile device management to accelerate patch adoption

bash

# Configuration example: disable QUIC via Chrome enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v QuicAllowed /t REG_DWORD /d 0 /f

# Linux/macOS: place the following in the managed policies JSON file
# /etc/opt/chrome/policies/managed/quic_policy.json
# {
#   "QuicAllowed": false
# }