CVE-2026-79034: Google Chrome CORS Information Disclosure

CVE-2026-79034 Overview

CVE-2026-79034 is an information disclosure vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page. Google categorizes the Chromium security severity as Medium, while the NVD assigns a lower base score because exploitation requires prior renderer compromise and user interaction.

Critical Impact
Attackers with a compromised renderer process can exfiltrate cross-origin data, bypassing the same-origin policy protections that CORS is designed to enforce.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Desktop)
Chromium-based browsers that incorporate the vulnerable CORS logic
Embedded Chromium components in downstream applications until rebased on the patched version

Discovery Timeline

2026-08-25 - CVE-2026-79034 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79034

Vulnerability Analysis

The vulnerability resides in Chrome's CORS enforcement path. CORS is a browser mechanism that governs when a document from one origin may read responses from another origin. When the enforcement logic is bypassed or leaks response metadata, cross-origin confidentiality is broken.

Exploitation requires that the attacker has already compromised the renderer process. In Chrome's multi-process model, the renderer is sandboxed and is not supposed to observe cross-origin response bodies unless CORS explicitly permits it. This flaw allows a controlled renderer to extract data from other origins loaded in the same browser session. The impact is limited to confidentiality, with no integrity or availability impact according to the CVSS vector.

Root Cause

The root cause is improper isolation in the CORS handling code path within the browser's networking stack. Response data that should have been filtered before reaching the renderer becomes observable to renderer code under specific conditions triggered by a crafted HTML page. Further technical detail is tracked in Chromium Issue #532957785.

Attack Vector

The attack chain requires two stages. First, the attacker must compromise the renderer process, typically by chaining another Chrome vulnerability such as a type confusion or use-after-free in the JavaScript engine. Second, the attacker delivers a crafted HTML page that triggers the CORS leak, allowing the compromised renderer to read cross-origin responses. Because user interaction is required, delivery commonly occurs through phishing links, malvertising, or watering-hole pages. No public proof-of-concept or exploit is currently available.

See the Chromium Issue Tracker entry and the Google Chrome Desktop Update for vendor references.

Detection Methods for CVE-2026-79034

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 after the patch release window
Unexpected outbound requests from browser processes to attacker-controlled domains following visits to untrusted pages
Renderer processes exhibiting anomalous child process behavior or crash signatures consistent with prior renderer exploitation

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts below 152.0.7977.65
Correlate browser telemetry with proxy or DNS logs to identify sessions that load rare or newly registered domains before generating cross-origin request bursts
Hunt for browser-spawned processes writing to sensitive locations, which may indicate a chained renderer exploit preceding CORS abuse

Monitoring Recommendations

Ingest endpoint browser process telemetry into a centralized data lake for version and behavior analytics
Alert on Chrome crash reports that reference the renderer process combined with subsequent network anomalies
Track patch compliance metrics for Chrome and Chromium-based browsers on a daily cadence until fleet coverage reaches 100 percent

How to Mitigate CVE-2026-79034

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux desktops
Force-restart Chrome after update to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded Chromium runtimes to confirm they have rebased on the fixed version

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update advisory. Administrators should deploy version 152.0.7977.65 or later through their managed browser update channel.

Workarounds

Enforce automatic browser updates through group policy or mobile device management to eliminate version drift
Restrict browsing on high-value hosts through URL filtering and block newly registered or low-reputation domains
Apply site isolation and strict cross-origin policies at the application layer, including Cross-Origin-Resource-Policy and Cross-Origin-Opener-Policy response headers

bash

# Configuration example: enforce Chrome auto-update via policy on Linux
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/update_policy.json
{
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}
EOF