CVE-2026-79016: Google Chrome SVG XSS Vulnerability

CVE-2026-79016 Overview

CVE-2026-79016 is an observable discrepancy vulnerability [CWE-203] in the Scalable Vector Graphics (SVG) implementation of Google Chrome prior to version 152.0.7977.65. A remote attacker can leverage a crafted HTML page to obtain cross-origin data, bypassing the same-origin policy that isolates content between web origins. Chromium classifies the security severity as Medium.

The flaw allows adversaries to infer or extract data from resources loaded from other origins by observing side-channel differences in SVG rendering. Cross-origin leaks of this class can expose authenticated user content, session-scoped data, and other sensitive resources served by unrelated web applications.

Critical Impact
Remote attackers can extract cross-origin data from a victim's browser by luring the user to a crafted HTML page, undermining browser origin isolation guarantees.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable SVG rendering code
Downstream Chromium forks that have not merged the upstream fix

Discovery Timeline

2026-08-25 - CVE-2026-79016 published to the National Vulnerability Database
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79016

Vulnerability Analysis

The vulnerability resides in Chrome's SVG subsystem and is classified as an observable discrepancy [CWE-203]. Observable discrepancy issues arise when the behavior, timing, or output of a rendering operation differs based on the content of cross-origin data. Attackers observe those differences to infer information they should not be able to read directly.

Because SVG can reference and compose external resources, filters, and styles, subtle differences in rendering paths can leak state about resources loaded from another origin. The result is a same-origin policy bypass that yields cross-origin data disclosure without requiring code execution in the browser process.

The attack requires only that a victim load a crafted HTML page. No authentication on the attacker's site is needed, and interaction beyond visiting the page is not required to trigger the disclosure primitive.

Root Cause

The root cause is an information-flow gap in the SVG rendering pipeline. Rendering decisions that should be opaque to a hosting page instead produce observable side effects. Those side effects allow an attacker's script to distinguish between different possible values of cross-origin content.

Attack Vector

Exploitation follows a standard cross-origin leak pattern. An attacker hosts a page that embeds SVG constructs referencing or interacting with a victim origin. The attacker's JavaScript then measures the observable discrepancy produced by the SVG pipeline to reconstruct cross-origin bytes or state.

The vulnerability mechanism is documented in the Chromium Issue Tracker #497854976 and the Google Chrome Stable Update announcement. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2026-79016

Indicators of Compromise

Chrome desktop clients reporting a version string earlier than 152.0.7977.65 in browser telemetry or User-Agent logs.
Outbound requests from user endpoints to unfamiliar domains that serve HTML embedding large volumes of SVG <use>, <filter>, or <foreignObject> elements referencing third-party origins.
Anomalous cross-origin resource fetches from browser sessions immediately following navigation to newly registered or low-reputation domains.

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome or Chromium-based installation below 152.0.7977.65.
Inspect web proxy and DNS logs for user visits to pages that combine third-party SVG rendering with scripted timing or pixel-sampling measurement primitives.
Correlate authentication-bearing sessions with subsequent visits to untrusted origins to identify cross-origin leak attempt patterns.

Monitoring Recommendations

Enable browser management telemetry to continuously report installed Chrome versions and update status.
Alert on endpoints that remain on outdated Chrome builds beyond the organization's patch service-level agreement.
Monitor for phishing and malvertising campaigns that direct users to attacker-controlled HTML pages, since these are the practical delivery mechanism.

How to Mitigate CVE-2026-79016

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Push the update through enterprise management tools such as Chrome Browser Cloud Management, Group Policy, or MDM to ensure timely rollout.
Restart browser sessions after the update, since Chrome only applies patched binaries on relaunch.

Patch Information

Google addressed CVE-2026-79016 in the Stable channel release detailed in the Google Chrome Stable Update announcement. Chromium-based browser vendors, including Microsoft Edge, Brave, Opera, and Vivaldi, typically merge upstream Chromium fixes; administrators should confirm the corresponding vendor build includes the SVG fix from Chromium Issue Tracker #497854976.

Workarounds

Enforce automatic Chrome updates through enterprise policy and disable the option for users to defer restarts.
Restrict browsing to trusted origins using URL filtering or Safe Browsing enhanced protection until patch deployment completes.
Advise users to avoid clicking links from untrusted email, messaging, or advertising sources until all managed browsers report the fixed version.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version