CVE-2026-79024: Google Chrome Information Disclosure Flaw

CVE-2026-79024 Overview

CVE-2026-79024 is an information disclosure vulnerability in the ServiceWorker component of Google Chrome. Versions of Chrome prior to 152.0.7977.65 allow a remote attacker to obtain sensitive information via a crafted HTML page. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium rates the security severity as Medium. Exploitation requires user interaction, such as visiting an attacker-controlled webpage, and does not require authentication.

Critical Impact
A remote attacker can leverage a malicious HTML page to leak sensitive browser data through the ServiceWorker interface, breaking web origin confidentiality boundaries.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers using the affected ServiceWorker code path
Desktop Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79024 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79024

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker implementation. ServiceWorkers are background scripts that intercept network requests, cache responses, and enable offline capabilities for web applications. A flaw in how the ServiceWorker handles or exposes data allows an attacker-controlled origin to read information that should remain isolated by the same-origin policy.

The defect maps to CWE-200, an exposure of sensitive information to an unauthorized actor. Successful exploitation compromises confidentiality without affecting integrity or availability. Google's Chromium project has not published detailed root-cause information, which is standard practice until patch uptake reaches a safe threshold. Additional technical context is tracked in Chromium Issue Tracker #517634590.

Root Cause

The root cause is an information leak within the ServiceWorker component. The specific code path is embargoed in the Chromium bug tracker. Based on the CWE-200 classification and prior ServiceWorker issues, the flaw likely involves improper isolation of cross-origin resource metadata, timing signals, or cached response data returned to a document that should not have access to that content.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the victim to visit it, for example through phishing, malvertising, or a compromised site. The page registers or interacts with a ServiceWorker in a manner that triggers the leak. No elevated privileges are required, and the scope is unchanged, meaning the attacker gains data available within the browsing context boundary.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker #517634590 for tracking details.

Detection Methods for CVE-2026-79024

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints.
User navigation to newly registered or low-reputation domains that install ServiceWorkers with unusual scope claims.
Anomalous ServiceWorker registrations persisting across sessions with fetch handlers targeting sensitive origins.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65 as vulnerable.
Correlate browser telemetry with proxy or DNS logs to identify visits to suspicious pages that request serviceWorker.register().
Review browser extension and enterprise policy logs for changes to ServiceWorker allowlists.

Monitoring Recommendations

Monitor Chrome update compliance through enterprise management tooling and alert on stale versions.
Track outbound HTTP requests originating from ServiceWorker fetch events for exfiltration patterns.
Enable and centralize browser security event logs, including navigations to attacker-controlled URLs identified in threat intelligence feeds.

How to Mitigate CVE-2026-79024

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart the browser after applying the update to ensure the patched binaries load.
Push the update through enterprise management platforms rather than relying on user-initiated updates.
Communicate risk guidance to users, including avoidance of untrusted links until patching completes.

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. The fixed version is 152.0.7977.65 for desktop. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their respective vendors integrate the upstream patch.

Workarounds

Restrict browsing to trusted sites through enterprise URL filtering while the patch is deployed.
Disable ServiceWorker functionality selectively via enterprise policy for high-risk user groups if the browser build cannot be updated immediately.
Enforce short browser update deadlines using policies such as TargetVersionPrefix and RelaunchNotificationPeriod to force compliance.

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v RelaunchNotification /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v RelaunchNotificationPeriod /t REG_DWORD /d 86400000 /f