CVE-2026-79075: Chrome Geolocation Information Disclosure Flaw

CVE-2026-79075 Overview

CVE-2026-79075 is an information disclosure vulnerability in the Geolocation component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can craft a malicious HTML page that, combined with social engineering, leaks sensitive information from the browser. Google classified the Chromium security severity as Medium.

The flaw is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction, such as visiting an attacker-controlled page or clicking a crafted link.

Critical Impact
A remote attacker can obtain sensitive geolocation-related information from a targeted user through a crafted web page, undermining user privacy expectations enforced by Chrome's permission model.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable Chromium releases prior to version 152
Downstream Chromium forks that had not merged the upstream Geolocation fix

Discovery Timeline

2026-08-25 - CVE-2026-79075 published to the National Vulnerability Database
2026-08-26 - Entry last updated in the NVD database

Technical Details for CVE-2026-79075

Vulnerability Analysis

The vulnerability resides in Chrome's Geolocation subsystem, which mediates access to device location data through the browser's permission prompt and the W3C Geolocation API. A remote attacker can serve a crafted HTML page that induces the Geolocation component to expose sensitive information to script contexts that should not have received it.

Because exploitation requires user interaction, the attacker relies on social engineering. Typical scenarios include phishing links, malicious advertising, and lookalike domains that request geolocation while masquerading as legitimate services. The attack originates over the network and does not require prior authentication in the browser.

The issue is confidentiality-only. Google's advisory and the Chromium Issue Tracker #533093250 reference the fix as part of the Chrome 152 Stable channel release documented in the Google Chrome Stable Update.

Root Cause

The defect is an information exposure weakness [CWE-200] in the Geolocation code path. Data that should remain scoped to a trusted origin or permission context is made observable to attacker-controlled content rendered inside a crafted HTML page. Detailed technical notes remain restricted in the Chromium issue tracker pending broader patch adoption.

Attack Vector

Exploitation proceeds through the following steps:

The attacker hosts or injects a crafted HTML page containing Geolocation-related content designed to trigger the disclosure.
The victim is lured to the page through phishing, malvertising, or a compromised third-party site.
The user interacts with the page as required by Chrome's permission flow, or the crafted content abuses expected interaction patterns.
Sensitive information is returned to the attacker-controlled JavaScript context or exfiltrated to an attacker-controlled endpoint.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-79075

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints
Outbound HTTPS requests from browser processes to newly registered or low-reputation domains immediately after Geolocation permission prompts
Unexpected Geolocation API usage from pages loaded via email links, ad networks, or redirect chains

Detection Strategies

Inventory Chrome and Chromium-based browser versions across the fleet and flag hosts below 152.0.7977.65.
Correlate browser telemetry with proxy or DNS logs to identify visits to suspicious sites that request Geolocation access.
Alert on abnormal spikes in Geolocation permission prompts originating from non-corporate domains.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for version and behavioral analysis.
Monitor phishing infrastructure and typosquatted domains targeting frequently used corporate services.
Track updates to the Chrome Stable channel release notes to confirm patch deployment status.

How to Mitigate CVE-2026-79075

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
Restart browser sessions after the update to ensure the patched binaries are loaded.
Verify that enterprise policies do not pin Chrome to a vulnerable major version.

Patch Information

Google addressed CVE-2026-79075 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix is included in Chrome 152.0.7977.65 and later. Chromium-based browser vendors should merge the upstream change and ship a corresponding update. Additional context is available in Chromium Issue Tracker #533093250.

Workarounds

Disable the Geolocation API through enterprise policy by setting DefaultGeolocationSetting to block until patching completes.
Restrict Geolocation permission to a curated allowlist of trusted internal origins via GeolocationAllowedForUrls.
Reinforce user awareness training on unsolicited Geolocation prompts from unfamiliar sites.

bash

# Example Chrome enterprise policy (Windows registry) to block Geolocation by default
# HKLM\Software\Policies\Google\Chrome
# DefaultGeolocationSetting (DWORD) = 2   ; 2 = Do not allow any site to track physical location
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultGeolocationSetting /t REG_DWORD /d 2 /f