CVE-2026-79098: Google Chrome XSS Vulnerability

CVE-2026-79098 Overview

CVE-2026-79098 is a user interface misrepresentation vulnerability in the PermissionElement component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can craft a malicious HTML page that spoofs Chrome UI elements when combined with social engineering. The flaw is classified under CWE-451 (User Interface Misrepresentation of Critical Information). Chromium rates the internal security severity as Low. Exploitation requires user interaction, and the impact is limited to integrity of information displayed to the user.

Critical Impact
An attacker can visually spoof permission-related UI elements to deceive users into granting sensitive browser permissions or trusting attacker-controlled content.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable PermissionElement implementation
All operating system builds shipping the affected Chrome release channel

Discovery Timeline

2026-08-25 - CVE-2026-79098 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79098

Vulnerability Analysis

The vulnerability resides in the PermissionElement implementation in Google Chrome. PermissionElement is a Chromium feature that lets web pages embed permission request controls directly within page content. When a browser exposes permission prompts through in-page elements, the visual boundary between trusted browser chrome and attacker-controlled page content becomes critical.

In versions before 152.0.7977.65, an attacker can render page content that misrepresents the intended appearance or context of the PermissionElement. The user cannot reliably distinguish spoofed page content from legitimate permission UI. This class of flaw falls under CWE-451 and enables deception rather than direct code execution.

Root Cause

The root cause is insufficient isolation and rendering guarantees for PermissionElement content relative to attacker-controlled page markup. The element permits styling or layout conditions that let a malicious page mimic or obscure legitimate permission prompts. Users lack a reliable visual indicator confirming which element originates from the browser.

Attack Vector

Exploitation requires the victim to visit a crafted HTML page and interact with spoofed UI. A remote attacker hosts the malicious page, then uses phishing, malvertising, or a compromised site to drive visits. When the victim clicks what appears to be a legitimate control, they may unknowingly grant a permission or trust attacker-influenced content. No authentication or privileges are required on the target system. Refer to the Chromium Issue Tracker #514010111 and the Google Chrome Desktop Update for the vendor's technical notes.

Detection Methods for CVE-2026-79098

Indicators of Compromise

Chrome browser processes reporting version strings below 152.0.7977.65 in endpoint telemetry.
HTTP responses containing HTML that instantiates <permission> elements with unusual layered styling, transforms, or overlays.
User reports of permission prompts appearing in unexpected page locations or with atypical visual context.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running builds earlier than 152.0.7977.65.
Inspect web proxy or secure web gateway logs for pages that use the PermissionElement API in conjunction with heavy CSS transforms, opacity manipulation, or absolute positioning near browser chrome regions.
Correlate user-reported phishing incidents with recent Chrome permission grants for camera, microphone, geolocation, or notifications.

Monitoring Recommendations

Track Chrome update compliance through endpoint management dashboards until all hosts are on 152.0.7977.65 or later.
Monitor domains newly serving pages that embed permission controls and evaluate them against threat intelligence feeds.
Alert on anomalous spikes in permission grants recorded by browser policy telemetry, particularly notification and geolocation permissions.

How to Mitigate CVE-2026-79098

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart browser processes after update to ensure the patched binary is loaded.
Communicate awareness guidance to users about permission prompts on unfamiliar sites.

Patch Information

Google addressed CVE-2026-79098 in Chrome Stable channel release 152.0.7977.65. Details are published in the Google Chrome Desktop Update announcement and tracked in Chromium Issue Tracker #514010111. Chromium-based browser vendors should incorporate the upstream fix in their next release.

Workarounds

Enforce automatic Chrome updates through enterprise policy so users cannot defer critical browser patches.
Use enterprise policy to restrict or deny sensitive permissions (camera, microphone, geolocation, notifications) by default on untrusted sites.
Apply URL allow-listing for high-value user populations to reduce exposure to attacker-controlled pages hosting the exploit.

bash

# Configuration example: Chrome enterprise policy to restrict default permissions
# Windows registry (HKLM\SOFTWARE\Policies\Google\Chrome\)
DefaultGeolocationSetting = 2   # Block
DefaultNotificationsSetting = 2 # Block
DefaultMediaStreamSetting = 2   # Block camera/microphone by default

# macOS/Linux managed preferences (JSON)
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "DefaultMediaStreamSetting": 2,
  "ComponentUpdatesEnabled": true
}