CVE-2026-79104: Google Chrome Sensor Information Disclosure

CVE-2026-79104 Overview

CVE-2026-79104 is a missing authorization vulnerability [CWE-862] in the Sensor component of Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can obtain sensitive information by serving a crafted HTML page to the victim. Google classifies the Chromium security severity as Medium.

The flaw does not directly grant code execution. Instead, it enables information disclosure when chained with a prior renderer compromise, making it useful as a secondary stage in a multi-step browser exploit chain.

Critical Impact
Attackers with a compromised renderer process can read sensitive sensor-derived data from the browser through a crafted HTML page, bypassing the authorization checks that normally gate access to Sensor APIs.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that incorporate the vulnerable Sensor code path
Downstream builds tracking the Chrome Stable channel before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79104 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79104

Vulnerability Analysis

The vulnerability resides in Chrome's Sensor implementation, which exposes device sensor data to web content through the Generic Sensor API. The component fails to enforce required authorization checks before returning sensor data to the renderer.

Because the missing check sits in a component reachable from the renderer, an attacker who has already achieved renderer compromise can query the Sensor interface and receive data that should be gated. The result is disclosure of sensitive information that Chrome's security model intends to withhold from untrusted web principals.

The attack requires user interaction and has high attack complexity, since the adversary must first compromise the renderer process and then deliver a crafted HTML page. Successful exploitation impacts confidentiality only; integrity and availability are unaffected.

Root Cause

The root cause is a missing authorization check [CWE-862] on a Sensor code path. Chrome relies on permission and origin checks to decide whether a caller may read sensor data. In the vulnerable version, one of these checks is absent or bypassable from a compromised renderer, so the browser process returns data without verifying that the caller is entitled to it.

Attack Vector

Exploitation proceeds in two stages. First, the attacker compromises the renderer process, typically by chaining a separate memory corruption or logic bug triggered from attacker-controlled web content. Second, the attacker uses the compromised renderer to invoke the Sensor interface with a crafted request delivered through an HTML page, retrieving data that authorization would normally block.

No verified proof-of-concept code is publicly available. Technical details are tracked in Chromium Issue #497017869 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-79104

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 after the patch release window
Unexpected renderer process crashes or restarts preceding anomalous outbound traffic
Web content invoking Sensor APIs from origins that do not typically request sensor access

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below 152.0.7977.65
Monitor for renderer process anomalies such as repeated crashes, unusual child process spawning, or sandbox escapes that could indicate the prerequisite renderer compromise
Correlate browser telemetry with proxy or DNS logs to identify sessions where crafted HTML pages are loaded from low-reputation domains

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized analytics platform to identify Chrome versions and process behavior at scale
Track Chrome update compliance as a continuous control rather than a point-in-time check
Alert on browser exploit indicators such as renderer sandbox violations, unexpected inter-process communication patterns, and post-exploitation network beacons

How to Mitigate CVE-2026-79104

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binary is loaded across all user sessions
Update Chromium-based browsers and embedded WebView components to builds that incorporate the fix

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog. The corresponding upstream tracking entry is Chromium Issue #497017869. Administrators managing Chrome through enterprise policy should confirm that automatic updates are enabled and that the target version is 152.0.7977.65 or higher.

Workarounds

Enforce Chrome auto-update through enterprise policy where feasible to close the exposure window
Restrict use of Chrome to browse untrusted content until the patched version is deployed fleet-wide
Use site isolation and strict extension controls to reduce the likelihood of a renderer compromise that would be the prerequisite for exploitation

bash

# Verify installed Chrome version on Linux and macOS
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or higher

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv