CVE-2026-78897: Google Chrome Information Disclosure Flaw

CVE-2026-78897 Overview

CVE-2026-78897 is a missing authorization vulnerability in the BrowserTag component of Google Chrome. Versions prior to 152.0.7977.65 fail to enforce proper authorization checks, allowing a remote attacker to obtain sensitive information via a crafted Chrome extension combined with social engineering. The flaw is tracked under [CWE-862: Missing Authorization] and Chromium classifies its security severity as Low, while the National Vulnerability Database (NVD) records it as Medium. Exploitation requires user interaction, since the target must install or interact with the malicious extension. No public proof-of-concept, exploit code, or evidence of in-the-wild abuse has been reported.

Critical Impact
A remote attacker who convinces a user to install a crafted Chrome extension can read sensitive browser information due to missing authorization in the BrowserTag component.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based builds incorporating the vulnerable BrowserTag implementation
All operating system distributions of Chrome Stable channel prior to the fixed release

Discovery Timeline

2026-08-25 - CVE-2026-78897 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78897

Vulnerability Analysis

The vulnerability resides in Chrome's BrowserTag component, which manages tag-based browser content elements. The component performs an action or exposes data without first verifying that the caller has the required permission. A Chrome extension crafted by the attacker can invoke the affected code path and receive sensitive information it should not be able to access.

Exploitation requires the victim to install the malicious extension, which is why the CVSS vector marks user interaction as required. Once installed, the extension operates within the browser context and abuses the missing authorization check to read data across boundaries that would normally isolate it. Impact is scoped to confidentiality; integrity and availability are not affected.

Root Cause

The root cause is an authorization gap inside BrowserTag. The component exposes functionality to extension callers without validating whether the calling context holds the necessary permissions. This is a classic [CWE-862] pattern where an access control decision is either omitted or performed after the sensitive operation is already executed.

Attack Vector

The attacker publishes or distributes a crafted Chrome extension and relies on social engineering to convince the victim to install it. After installation, the extension issues API calls to the vulnerable BrowserTag code path and harvests data returned by the browser. Because the delivery mechanism is a browser extension, the attack is remote and does not require network-adjacent access, but it does require user consent to install the extension. Refer to the Chromium Issue #513486883 tracker for authoritative technical details.

Detection Methods for CVE-2026-78897

Indicators of Compromise

Installation of unsigned or low-reputation Chrome extensions from outside the Chrome Web Store or from newly published developer accounts.
Chrome browser processes reporting version strings earlier than 152.0.7977.65 on managed endpoints.
Extensions requesting broad host permissions or access to webview, tag, or embedded frame APIs without a clear business justification.

Detection Strategies

Inventory Chrome versions across the fleet and flag any browser reporting a build below 152.0.7977.65.
Audit installed Chrome extensions and cross-reference extension IDs against approved allow-lists.
Monitor endpoint telemetry for Chrome child processes spawned from recently installed extensions and correlate with browsing activity to sensitive internal applications.

Monitoring Recommendations

Enable enterprise reporting via Chrome Browser Cloud Management to stream extension install and version events into a central log store.
Alert on extension installations that occur outside of managed deployment channels.
Track outbound network connections from Chrome to newly registered domains, which may signal extension-based exfiltration.

How to Mitigate CVE-2026-78897

Immediate Actions Required

Update Google Chrome Desktop to version 152.0.7977.65 or later on all managed endpoints.
Force-restart Chrome after the update so the patched binary is loaded into memory.
Review installed extensions and remove any that are unknown, unsigned, or unnecessary.

Patch Information

Google addressed CVE-2026-78897 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Upgrading to 152.0.7977.65 or newer removes the missing authorization condition in BrowserTag. The upstream fix is tracked in Chromium Issue #513486883.

Workarounds

Enforce an extension allow-list via ExtensionInstallAllowlist and block all others with ExtensionInstallBlocklist set to *.
Restrict extension installation sources to the Chrome Web Store using enterprise policy.
Deliver security awareness guidance warning users not to install extensions requested via unsolicited links or messages.

bash

# Configuration example: Chrome enterprise policy to restrict extensions (Linux managed policy JSON)
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionInstallSources": [
    "https://chromewebstore.google.com/*"
  ]
}