CVE-2026-79028 Overview
CVE-2026-79028 is an observable discrepancy vulnerability in the Network component of Google Chrome versions prior to 152.0.7977.65. The flaw enables a remote attacker to obtain sensitive information by luring a user to a crafted HTML page. Chromium classifies the security severity as Medium. The issue is tracked under CWE-203: Observable Discrepancy, a side-channel class where behavioral differences leak information across security boundaries. Exploitation requires user interaction, and the attack complexity is high, but no privileges are needed. Google addressed the defect in the Chrome Stable Channel update published to the Chrome Releases blog.
Critical Impact
A remote attacker can leverage observable behavioral differences in Chrome's Network stack to exfiltrate sensitive cross-origin information from a victim's browser session.
Affected Products
- Google Chrome Desktop versions prior to 152.0.7977.65
- Chromium-based browsers that inherit the vulnerable Network stack
- All supported desktop platforms served by the Chrome Stable Channel
Discovery Timeline
- 2026-08-25 - CVE-2026-79028 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79028
Vulnerability Analysis
The vulnerability lives in Chrome's Network component and is categorized as an observable discrepancy [CWE-203]. Observable discrepancies occur when a system exposes measurable differences in behavior, timing, response size, or error handling that depend on protected state. An attacker who can trigger network requests from within a victim's browser can then measure the discrepancy and infer information that should remain isolated by the browser's origin model. The attack is fully remote and requires only that the user open a crafted HTML page. Because the impact is limited to confidentiality, integrity and availability of the browser process are not directly affected. The higher attack complexity reflects the precision needed to observe and correlate the leaked signal reliably.
Root Cause
The root cause is inconsistent handling within Chrome's Network stack that produces state-dependent, observable behavior. The specific defect is tracked in Chromium Issue #500492844, which remains access-restricted pending broader patch adoption. Because the discrepancy is exposed through legitimate network primitives, it bypasses standard same-origin protections without requiring memory corruption.
Attack Vector
Exploitation begins when a victim visits attacker-controlled or attacker-influenced content. The malicious page issues carefully shaped network requests from the browser context. The attacker then observes side-channel signals returned to the page, such as timing variances or response metadata differences. These signals allow inference of cross-origin state. No authentication is required, and the payload is fully deliverable through standard HTML and JavaScript. The vulnerability is described in prose only because no verified public proof-of-concept code has been released; see the Chromium tracker for restricted technical details.
Detection Methods for CVE-2026-79028
Indicators of Compromise
- Chrome browser processes reporting version strings earlier than 152.0.7977.65 in enterprise inventory feeds
- Web traffic to newly registered or low-reputation domains serving HTML pages that generate high-frequency, uniform sub-resource requests
- Repeated cross-origin fetch or XMLHttpRequest patterns from a single tab that correlate with side-channel measurement loops
Detection Strategies
- Inventory endpoints for outdated Chrome installations using software asset management or EDR telemetry
- Inspect proxy and DNS logs for browsing sessions containing high volumes of repeated, timing-sensitive requests to third-party origins
- Correlate browser process telemetry with outbound network flows to identify pages that exhibit measurement-loop behavior
Monitoring Recommendations
- Alert on Chrome versions below 152.0.7977.65 reported by managed endpoints
- Monitor for anomalous JavaScript execution patterns associated with observable-discrepancy probing
- Track access to newly observed domains from browsers that have not yet applied the Stable Channel update
How to Mitigate CVE-2026-79028
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed desktops
- Force a browser restart through group policy or MDM to ensure the patched binary is loaded
- Verify Chromium-based third-party browsers are on builds that incorporate the fixed Network component
Patch Information
Google released the fix in the Chrome Stable Channel update announced at the Chrome Releases blog. Administrators should validate deployment by confirming Chrome reports version 152.0.7977.65 or higher through chrome://version or centralized telemetry. Enterprise deployments using the Chrome Enterprise MSI or update policies should confirm the update ring reaches all endpoints. The underlying defect is tracked at Chromium Issue #500492844.
Workarounds
- Restrict browsing to trusted destinations using URL filtering while patches are staged
- Enforce Chrome auto-update policies through the Chrome Enterprise administrative templates
- Apply content security controls at the web proxy to block newly registered or uncategorized domains for high-risk user groups
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
