CVE-2026-79018: Google Chrome Information Disclosure Flaw

CVE-2026-79018 Overview

CVE-2026-79018 is an information disclosure vulnerability in the FoldableAPIs component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to obtain sensitive information through a crafted HTML page. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium engineers classify the internal security severity as Low, while the NVD assigns a medium rating based on network attack vector and user interaction requirements.

Critical Impact
A remote attacker can leak sensitive browser or device information by convincing a user to visit an attacker-controlled HTML page.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop Stable channel)
Chromium-based browsers that embed the vulnerable FoldableAPIs code prior to the patched revision
All operating system builds of Chrome shipping the vulnerable component

Discovery Timeline

2026-08-25 - CVE-2026-79018 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79018

Vulnerability Analysis

The vulnerability resides in Chrome's FoldableAPIs implementation. FoldableAPIs expose device posture and screen-segment information to web content so that pages can adapt layout to foldable and dual-screen hardware. Improper handling in this component allows a crafted HTML page to read data that should not be exposed to arbitrary origins.

Exploitation requires the victim to load an attacker-controlled page, matching the User Interaction Required condition. No privileges or prior authentication are needed. Successful exploitation compromises confidentiality only; the flaw does not permit code execution or modification of browser state.

The root defect is categorized under CWE-200 as improper exposure of sensitive information. The impact set is narrow but includes data an attacker can weaponize for fingerprinting, targeted follow-on attacks, or cross-origin reconnaissance.

Root Cause

The root cause is insufficient origin or context isolation within the FoldableAPIs surface. Web-exposed interfaces return information without enforcing the boundaries expected between arbitrary third-party origins and privileged device state. Details on the specific fix are tracked in Chromium Issue #522803735.

Attack Vector

A remote attacker hosts a crafted HTML page that invokes FoldableAPIs methods or reads their properties. When a victim running a vulnerable Chrome build visits the page, script on the page extracts sensitive values and exfiltrates them over the network. No sandbox escape or memory corruption primitive is required. See the Chrome Releases Stable Channel Update for vendor coverage.

No public proof-of-concept is available. The EPSS model estimates a 0.265% probability of exploitation activity.

Detection Methods for CVE-2026-79018

Indicators of Compromise

Outbound HTTP requests from Chrome carrying encoded device-posture, screen-segment, or window-arrangement values to non-first-party domains
Browser telemetry showing pages that query FoldableAPIs interfaces immediately followed by beacon or fetch calls to external endpoints
User reports of unexpected fingerprinting or targeted content after visiting untrusted sites on unpatched Chrome versions

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 152.0.7977.65
Inspect web proxy and DNS logs for requests to newly registered domains that serve HTML invoking foldable or window segmentation APIs
Correlate endpoint browser version data with network egress patterns to identify potentially exposed users

Monitoring Recommendations

Ingest Chrome version telemetry into the SIEM and alert on hosts that fall behind the patched version
Monitor for anomalous JavaScript execution patterns that reference foldable posture APIs on sites without a legitimate need
Track vendor advisories from the Chrome Releases blog to detect follow-on issues in the same component

How to Mitigate CVE-2026-79018

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force a browser restart after update deployment to ensure the patched binary is active
Verify that auto-update is enabled and functional on unmanaged and BYOD devices

Patch Information

Google addressed CVE-2026-79018 in the Stable channel release documented at the Chrome Releases Stable Channel Update for Desktop. The fix is included in Chrome 152.0.7977.65 and later. Technical fix details are tracked in Chromium Issue #522803735.

Workarounds

Restrict browsing to trusted origins through enterprise web filtering until Chrome is patched
Deploy Chrome enterprise policies that block execution of untrusted third-party sites on high-risk user groups
Educate users to avoid clicking links from untrusted sources while an updated build is being staged

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Confirm the reported version is >= 152.0.7977.65