CVE-2026-79107: Google Chrome TabGroups Information Leak

CVE-2026-79107 Overview

CVE-2026-79107 is an incorrect authorization vulnerability [CWE-863] in the TabGroups component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the flaw by delivering crafted network traffic to a user who interacts with malicious content. Successful exploitation leaks sensitive information from the browser context. The Chromium project rates the security severity as Medium.

Critical Impact
A remote attacker can leak sensitive information from Chrome's TabGroups by serving crafted content to a user, bypassing intended authorization boundaries between browsing contexts.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable TabGroups implementation
Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79107 published to the National Vulnerability Database
2026-08-26 - Entry last modified in NVD

Technical Details for CVE-2026-79107

Vulnerability Analysis

The flaw resides in Chrome's TabGroups feature, which organizes and isolates related tabs within a browser window. Incorrect authorization checks allow content in one browsing context to obtain data it should not access. The issue is classified under CWE-863: Incorrect Authorization, indicating the code performs an authorization check but reaches the wrong decision.

The attack requires user interaction, such as visiting an attacker-controlled page or interacting with crafted content. Confidentiality impact is high, while integrity and availability are not affected. Exploitation does not require prior privileges, and the attack traverses the network.

An EPSS probability of 0.245% places this vulnerability in the 15th percentile for likelihood of exploitation activity within the next 30 days.

Root Cause

The root cause is an authorization check within the TabGroups logic that fails to enforce the intended boundary between tab groups or between browser origins associated with those groups. When the check evaluates a request from a lower-privileged context, it returns a permissive result and exposes data that should remain isolated. Refer to the Chromium Issue Tracker #511822878 for implementation-level details.

Attack Vector

An attacker hosts crafted content on a network-reachable resource and lures the target to load it in Chrome. When the user interacts with the page, the malicious content issues requests that traverse the flawed TabGroups authorization path. The response returns sensitive information from another tab group or origin, which the attacker exfiltrates over the same network channel.

No verified proof-of-concept code is publicly available. See the Google Chrome Stable Update advisory for the vendor description.

Detection Methods for CVE-2026-79107

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 after the patch release date
Unexpected outbound HTTP or HTTPS requests originating from browser tabs shortly after a user visits an unfamiliar site
Browser telemetry showing cross-tab-group data reads that do not align with normal user workflows

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag any build lower than 152.0.7977.65
Correlate web proxy logs with endpoint telemetry to identify sessions where a user visited unclassified sites followed by anomalous data egress
Monitor browser update channel status to confirm the stable channel has applied the August 2026 desktop update

Monitoring Recommendations

Ingest browser version and update status into a central data lake for continuous exposure reporting
Track user interaction with untrusted domains in combination with subsequent tab-group activity
Alert on Chrome processes that remain unpatched beyond an organization-defined remediation window

How to Mitigate CVE-2026-79107

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all desktop endpoints
Restart the browser after applying the update so the new binary is loaded into memory
Verify managed browser policies enforce automatic updates and prohibit downgrades

Patch Information

Google addressed CVE-2026-79107 in the Stable channel desktop release documented in the Chrome Releases blog. Administrators should confirm the deployed build number matches 152.0.7977.65 or higher on Windows, macOS, and Linux.

Workarounds

Restrict user access to untrusted external sites through enterprise proxy or DNS filtering until patching completes
Disable or limit use of the TabGroups feature via enterprise browser policy where operationally acceptable
Educate users to avoid interacting with unsolicited links and unfamiliar web content during the remediation window

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version