CVE-2026-78975 Overview
CVE-2026-78975 is an incorrect authorization vulnerability in the Document Object Model (DOM) implementation of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain sensitive information by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-863: Incorrect Authorization and rated Medium severity by the Chromium project. Successful exploitation requires user interaction but no authentication, and the impact is limited to confidentiality. Google addressed the issue in the Stable channel update for desktop.
Critical Impact
Remote attackers can access sensitive cross-origin information by luring users to a malicious webpage, undermining the browser's same-origin authorization boundary.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers sharing the vulnerable DOM authorization logic
- Downstream distributions bundling pre-152 Chrome builds
Discovery Timeline
- 2026-08-25 - CVE-2026-78975 published to NVD
- 2026-08-27 - Last updated in NVD database
- Vendor advisory: Google Chrome Stable Update
Technical Details for CVE-2026-78975
Vulnerability Analysis
The vulnerability resides in Chrome's DOM implementation, where authorization checks fail to correctly enforce access boundaries between web contexts. An attacker who controls a webpage can craft DOM operations that bypass the intended authorization logic. The browser then discloses information the origin should not be able to read. Because exploitation occurs entirely within the rendering pipeline, no privileged position on the network is required. Refer to the Chromium Issue Tracker #517398863 for restricted technical details.
Root Cause
The root cause is an incorrect authorization check [CWE-863] within DOM handling code. The affected code path validates a subject's identity but does not correctly evaluate whether that subject is authorized for the requested resource. This gap enables a crafted page to reach data that the browser's security model treats as protected.
Attack Vector
Exploitation is remote and requires user interaction. The attacker hosts or injects a crafted HTML page, then lures a victim to load it in a vulnerable Chrome build. Once loaded, the page issues DOM operations that trigger the flawed authorization check and read sensitive information. No credentials, extensions, or additional privileges are needed on the victim endpoint.
No public proof-of-concept is available. See the Chromium Issue Tracker #517398863 and the Google Chrome Stable Update advisory for further technical context.
Detection Methods for CVE-2026-78975
Indicators of Compromise
- Chrome browser processes reporting a version string below 152.0.7977.65 in endpoint inventory data.
- Outbound connections from user endpoints to newly registered or low-reputation domains serving HTML content shortly before sensitive data exfiltration events.
- Web proxy logs showing users following unsolicited links from email, chat, or social media to unfamiliar sites.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build prior to 152.0.7977.65.
- Correlate browser telemetry with URL categorization feeds to identify visits to phishing or malvertising infrastructure.
- Monitor for anomalous DOM-based data access patterns in browser isolation or DLP telemetry, when available.
Monitoring Recommendations
- Ingest browser version and patch-status telemetry into the SIEM and alert on out-of-date Chrome installations.
- Track user reports of unexpected content, redirects, or credential prompts that may indicate exposure to crafted pages.
- Review egress logs for sensitive data transfers immediately following visits to untrusted external domains.
How to Mitigate CVE-2026-78975
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
- Restart the browser after the update so the patched binaries load in place of the vulnerable version.
- Push the update through enterprise management channels such as Chrome Browser Cloud Management or endpoint configuration tools.
Patch Information
Google released the fix in the Stable channel update announced in the Google Chrome Stable Update advisory. Users on Chrome versions before 152.0.7977.65 must upgrade to receive the patched DOM authorization logic. Chromium-based browsers should adopt the corresponding upstream fix once their vendors publish releases.
Workarounds
- Restrict browsing to trusted sites using enterprise policy, URL filtering, or remote browser isolation until patching completes.
- Enable strict Site Isolation and disable non-essential experimental DOM features via Chrome enterprise policies.
- Train users to avoid unsolicited links and report suspicious pages that request unusual permissions or exhibit unexpected behavior.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output on patched systems: Google Chrome 152.0.7977.65 or later
# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
