CVE-2026-79022: Google Chrome Transactions Platform XSS

CVE-2026-79022 Overview

CVE-2026-79022 is a user interface (UI) misrepresentation vulnerability in the Transactions Platform component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can craft a malicious HTML page that spoofs UI elements shown to the user. Exploitation requires user interaction and social engineering to succeed. Chromium classifies the severity of this issue as Low, while NVD assigns it a medium rating. The weakness maps to [CWE-451] (User Interface Misrepresentation of Critical Information).

Critical Impact
An attacker who convinces a user to visit a crafted page can spoof legitimate browser UI elements, potentially misleading the user during transaction workflows.

Affected Products

Google Chrome (Desktop) versions prior to 152.0.7977.65
Chrome Transactions Platform component
Chromium-based browsers that ship the same component prior to the fix

Discovery Timeline

2026-08-25 - CVE-2026-79022 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79022

Vulnerability Analysis

The flaw resides in Chrome's Transactions Platform, the subsystem responsible for rendering transaction-related UI such as payment prompts and confirmation dialogs. The component fails to correctly represent critical UI state when handling attacker-controlled HTML content. As a result, a crafted page can visually overlap, mimic, or displace trusted browser chrome elements. A user relying on those UI cues to verify a transaction may be misled into approving or trusting attacker-controlled content. The issue does not permit code execution, memory corruption, or direct data theft on its own.

Root Cause

The root cause is improper separation between web-controlled rendering and trusted browser UI in the Transactions Platform. Chromium tracks the fix in Chromium Issue Report #514038302. The condition falls under [CWE-451], where security-relevant information is displayed in a way that a user cannot reliably distinguish authentic UI from attacker-supplied content.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts or delivers a crafted HTML page, typically through phishing, malvertising, or a compromised site. When the victim loads the page and interacts with a transaction flow, the attacker's content overlays or imitates legitimate Chrome UI. The attacker relies on social engineering to convert the visual confusion into a user-authorized action. No privileges are required on the target system.

No public proof-of-concept exploit is available for CVE-2026-79022. See the Google Chrome Stable Update advisory for vendor details.

Detection Methods for CVE-2026-79022

Indicators of Compromise

User reports of transaction prompts or dialogs that appear inconsistent with legitimate Chrome UI.
Browser telemetry showing navigations to newly registered or low-reputation domains immediately before transaction events.
Referrer chains from phishing lures or malvertising redirectors leading to pages that invoke Chrome transaction flows.

Detection Strategies

Inventory Chrome installations and flag any endpoint running a version earlier than 152.0.7977.65.
Correlate email and web proxy logs to identify phishing campaigns that direct users to crafted HTML pages targeting transaction UI.
Use browser management policies to log extension activity and unexpected UI-focused scripts on high-risk transaction pages.

Monitoring Recommendations

Alert on out-of-date Chrome versions across managed endpoints using existing asset and patch management tooling.
Monitor DNS and proxy logs for user visits to domains hosting spoofed transaction interfaces.
Track user-reported phishing submissions that reference payment or confirmation dialog anomalies.

How to Mitigate CVE-2026-79022

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Verify that Chrome auto-update is enabled and functioning through enterprise policy.
Re-brief users on verifying URLs and transaction prompts before approving payments or sensitive actions.

Patch Information

Google addressed CVE-2026-79022 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Upgrading to 152.0.7977.65 or newer removes the vulnerable code path in the Transactions Platform. Chromium-based browsers should apply the equivalent upstream fix tracked in Chromium Issue Report #514038302.

Workarounds

Restrict browsing to trusted sites during high-value transactions using web filtering or enterprise browser policies.
Deploy phishing-resistant controls such as URL reputation filtering and email link rewriting to reduce delivery of crafted pages.
Enforce user training that treats unexpected transaction prompts as suspicious until the URL and context are verified.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS/Linux
google-chrome --version