CVE-2026-78907: Google Chrome Information Disclosure Flaw

CVE-2026-78907 Overview

CVE-2026-78907 is an incorrect authorization vulnerability [CWE-863] in the WebProtect component of Google Chrome. Versions prior to 152.0.7977.65 fail to properly enforce authorization checks, allowing a remote attacker to leak sensitive information through a crafted HTML page. Google classifies the Chromium security severity as Medium.

Exploitation requires user interaction, such as visiting an attacker-controlled webpage. The vulnerability does not enable code execution or integrity impact, but it does expose confidential data to unauthorized origins.

Critical Impact
Remote attackers can leak sensitive information from Chrome users who visit a crafted HTML page, bypassing WebProtect authorization boundaries.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable WebProtect component
Desktop Chrome across Windows, macOS, and Linux Stable channels

Discovery Timeline

2026-08-25 - CVE-2026-78907 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78907

Vulnerability Analysis

The flaw resides in Chrome's WebProtect component, which is responsible for enforcing origin-based authorization decisions for web content. WebProtect fails to correctly validate the caller's authorization state before returning protected resources or metadata. As a result, an attacker-controlled page can request data that should be restricted to another security principal.

The issue is classified as Incorrect Authorization [CWE-863]. Chrome enforces the same-origin policy and additional privilege boundaries through components like WebProtect. When these checks are bypassed, information belonging to another origin or a privileged context can be observed by attacker script.

Exploitation leaks confidentiality only. Integrity and availability are not affected, and no privileges are required from the attacker beyond hosting the crafted content. User interaction is required because the victim must load the malicious page.

Root Cause

The root cause is a missing or improperly evaluated authorization check within WebProtect. The component permits an operation without verifying that the requesting context holds the necessary authorization. This aligns with the CWE-863 pattern where an access decision is made but the decision logic is flawed.

Attack Vector

The attack vector is network-based via a malicious or compromised web page. The attacker crafts HTML, and optionally JavaScript, that triggers the flawed WebProtect code path. When the victim loads the page in a vulnerable Chrome build, the attacker's script reads information that should be inaccessible across the security boundary.

The vulnerability manifests in the WebProtect authorization logic. See the Chromium Issue Tracker #503847023 for technical details once the entry becomes public.

Detection Methods for CVE-2026-78907

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory
Outbound requests from browsers to newly registered or low-reputation domains hosting HTML payloads that exercise WebProtect APIs
Unexpected cross-origin data appearing in browser telemetry, DOM storage, or web application logs

Detection Strategies

Query endpoint inventory for Chrome executables reporting a version string less than 152.0.7977.65
Correlate browser process telemetry with visits to unfamiliar domains immediately preceding sensitive data access anomalies in downstream applications
Review web proxy and DNS logs for user navigation to URLs delivered through phishing campaigns or malvertising that target Chrome users

Monitoring Recommendations

Track Chrome version distribution across the fleet using EDR software inventory and browser management policies
Alert on Chrome installations that fail to update within the organization's defined patch SLA
Monitor threat intelligence feeds for public proof-of-concept releases referencing CVE-2026-78907 or Chromium issue 503847023

How to Mitigate CVE-2026-78907

Immediate Actions Required

Update all Google Chrome installations to version 152.0.7977.65 or later on Windows, macOS, and Linux
Restart Chrome on end-user devices after the update installs to ensure the patched binary is loaded
Verify that automatic updates are enabled and functioning through Chrome Enterprise policies or MDM

Patch Information

Google released the fix in the Stable channel update announced on the Google Chrome Stable Update blog. Users running Chrome 152.0.7977.65 or later are no longer vulnerable. Chromium-based browsers should incorporate the corresponding upstream patch.

Workarounds

Restrict browsing to trusted sites through enterprise URL filtering until patch deployment completes
Deploy browser isolation for high-risk user groups such as executives and administrators
Enforce Chrome Enterprise policies that mandate the latest Stable channel and block outdated versions from accessing corporate resources

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion