CVE-2026-79023 Overview
CVE-2026-79023 is an incorrect authorization vulnerability in the Editing component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and enables a remote attacker to obtain sensitive information through a crafted HTML page. Chromium classifies the security severity as Medium. The weakness is tracked as CWE-863: Incorrect Authorization. Exploitation requires user interaction, typically visiting an attacker-controlled page, but no privileges are needed. Google addressed the issue in the Stable Channel update for desktop.
Critical Impact
A remote attacker can read sensitive browser data by convincing a user to load a crafted HTML page, breaking authorization boundaries in the Editing component.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers inheriting the vulnerable Editing component
- All operating systems supported by Chrome Stable Channel (Windows, macOS, Linux)
Discovery Timeline
- 2026-08-25 - CVE-2026-79023 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79023
Vulnerability Analysis
The vulnerability resides in Chrome's Editing component, which handles rich-text editing operations such as contenteditable regions, clipboard interaction, and document mutation APIs. Incorrect authorization checks allow a crafted HTML page to access data that should be shielded by same-origin or content-security boundaries. An attacker exploits the flaw by hosting a malicious page and enticing the victim to visit it. Because the outcome is information disclosure without integrity or availability impact, the primary risk is exposure of cross-origin content, form data, or other sensitive material rendered within the browser.
Root Cause
The root cause is a missing or improperly enforced authorization check inside Editing logic. Chromium tracks the underlying defect in Chromium Issue Tracker #517761566. When the Editing component performs an operation that should be gated by origin, permission, or user activation, the check is either absent or evaluated against the wrong context. This allows a page to trigger the operation on data belonging to a different security principal.
Attack Vector
The attack is fully remote and requires the victim to load attacker-controlled HTML in a vulnerable Chrome build. No authentication is needed. The attacker crafts a page that invokes Editing operations under conditions the authorization logic fails to reject. Successful exploitation returns sensitive information to the attacker's page, which can then exfiltrate it over the network.
No public proof-of-concept, ExploitDB entry, or CISA KEV listing has been observed for CVE-2026-79023 at the time of publication. Refer to the Chrome Stable Channel Update for vendor-provided technical context.
Detection Methods for CVE-2026-79023
Indicators of Compromise
- Chrome desktop clients reporting a version string earlier than 152.0.7977.65 in browser telemetry or user-agent logs
- Outbound requests to unfamiliar domains immediately following user visits to untrusted HTML content
- Unexpected clipboard or execCommand-related activity originating from unvetted origins in browser event logs
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
- Correlate web proxy logs with browsing to newly registered or low-reputation domains that serve HTML with rich editing constructs
- Enable enterprise browser reporting to surface page-level events involving cross-origin editing or clipboard access
Monitoring Recommendations
- Ingest Chrome Enterprise event logs and browser version telemetry into the SIEM for continuous version compliance monitoring
- Alert on endpoints that fail to apply Chrome auto-updates within the organization's patch SLA
- Track outbound HTTP POSTs from browser processes to non-corporate destinations shortly after navigation events
How to Mitigate CVE-2026-79023
Immediate Actions Required
- Update all Chrome desktop installations to version 152.0.7977.65 or later across Windows, macOS, and Linux
- Restart Chrome on end-user devices to ensure the patched binary is loaded into memory
- Verify Chromium-based third-party browsers have merged the corresponding upstream fix before treating them as remediated
Patch Information
Google released the fix in the Stable Channel for desktop. Administrators should deploy version 152.0.7977.65 or later using Chrome Enterprise policies, mobile device management (MDM), or standard software distribution tooling. Full details are available in the Chrome Stable Channel Update advisory and Chromium Issue Tracker #517761566.
Workarounds
- Enforce the RelaunchNotification and RelaunchNotificationPeriod enterprise policies to compel timely restarts after updates
- Restrict browsing to trusted sites through URL allowlists or secure web gateway policies until patches are fully deployed
- Educate users to avoid opening unsolicited links, which reduces exposure to the user-interaction requirement of this flaw
# Configuration example: verify Chrome version on Linux endpoints
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later
# Windows registry check for managed Chrome update policy
reg query "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
