CVE-2026-79038: Google Chrome Information Disclosure Flaw

CVE-2026-79038 Overview

CVE-2026-79038 is an incorrect authorization vulnerability [CWE-863] in the WebProtect component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to obtain sensitive information through a crafted HTML page. Chromium classifies the security severity as Medium. Exploitation requires user interaction, such as visiting an attacker-controlled web page. Successful exploitation can expose sensitive browser-managed information to remote parties without authentication.

Critical Impact
A remote attacker can bypass authorization checks in WebProtect via a crafted HTML page and read sensitive information from the affected Chrome instance.

Affected Products

Google Chrome versions prior to 152.0.7977.65 (Stable channel, Desktop)
Chromium-based browsers that ship the vulnerable WebProtect component
Deployments that have not yet applied the Stable channel update announced in August 2026

Discovery Timeline

2026-08-25 - CVE-2026-79038 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79038

Vulnerability Analysis

The vulnerability resides in Chrome's WebProtect component and is categorized as Incorrect Authorization [CWE-863]. WebProtect fails to correctly enforce authorization boundaries when a page performs specific operations, allowing an attacker to reach data that should be gated behind a permission or origin check. An attacker hosts a crafted HTML page and lures a user into visiting it. Once loaded, the page triggers the flawed authorization path and reads information the origin should not have access to. The impact is limited to confidentiality; integrity and availability of the browser process are not directly affected. The Exploit Prediction Scoring System (EPSS) probability is 0.384% as of the August 2026 scoring date, indicating low near-term exploitation likelihood.

Root Cause

The root cause is an authorization check within WebProtect that does not correctly validate the requesting context before returning protected data. Because the enforcement logic is incomplete, a scripted page can invoke a code path that bypasses the intended permission boundary. This is a design and validation defect rather than a memory safety issue.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted HTML page through a malicious website, a compromised third-party site, a malvertising redirect, or a phishing link. When the victim's Chrome browser renders the page, embedded JavaScript exercises the WebProtect authorization flaw and exfiltrates sensitive data to an attacker-controlled endpoint. No elevated privileges are needed on the target system, and no prior authentication to the browser is required.

No public proof-of-concept code has been released for CVE-2026-79038. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor-supplied technical details.

Detection Methods for CVE-2026-79038

Indicators of Compromise

Chrome browser processes on endpoints reporting a version string below 152.0.7977.65 after the patch release date.
Outbound HTTP or HTTPS connections from chrome.exe to newly registered or low-reputation domains immediately after a user visits an unfamiliar site.
Web proxy logs showing unexpected POST requests carrying serialized browser data to third-party hosts.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any instance below 152.0.7977.65.
Correlate browser telemetry with proxy and DNS logs to identify anomalous data egress that follows page loads from untrusted origins.
Monitor for phishing campaigns that direct users to attacker-hosted HTML pages, since exploitation requires user interaction.

Monitoring Recommendations

Ingest endpoint browser version data and web proxy logs into a centralized analytics platform for continuous coverage.
Alert on Chrome child processes making network calls to domains not present in enterprise allowlists.
Track Chrome auto-update health to confirm the Stable channel patch has been applied fleet-wide.

How to Mitigate CVE-2026-79038

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Verify that Chrome auto-update is enabled and functioning; restart the browser to apply pending updates.
Communicate to users the risk of clicking unknown links, since exploitation requires loading a crafted HTML page.

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. Administrators should deploy Chrome 152.0.7977.65 or later. See the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for release details.

Workarounds

Enforce enterprise policy to block navigation to uncategorized or newly registered domains until patching is complete.
Use web filtering to reduce exposure to malvertising and phishing pages that could deliver the crafted HTML payload.
Restrict Chrome extensions and site permissions to reduce the sensitive data available to a compromised origin.

bash

# Verify installed Chrome version on Linux or macOS
google-chrome --version

# Windows PowerShell: check installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force update check via Chrome URL (open in browser)
# chrome://settings/help