CVE-2026-79122: Google Chrome SignIn Information Disclosure

CVE-2026-79122 Overview

CVE-2026-79122 is an information disclosure vulnerability in the SignIn component of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain sensitive information by delivering crafted network traffic to a targeted browser. Google classifies the Chromium security severity as Medium, and the flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Remote attackers can leak sensitive data handled by Chrome's SignIn component through crafted network traffic, without user interaction or authentication.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable SignIn component
Managed Chrome deployments on Windows, macOS, and Linux running unpatched builds

Discovery Timeline

2026-08-25 - CVE-2026-79122 published to the National Vulnerability Database
2026-08-27 - Last updated in the NVD database
2026-08 - Google releases fixed Chrome Stable channel build 152.0.7977.65 (Chrome Releases)

Technical Details for CVE-2026-79122

Vulnerability Analysis

The flaw resides in Chrome's SignIn component, which handles authentication flows tied to Google account services within the browser. Chrome versions before 152.0.7977.65 mishandle data processed during sign-in exchanges, allowing a remote attacker who can influence network traffic to extract sensitive information. The issue is classified as an information exposure weakness ([CWE-200]) rather than a memory corruption or code execution defect. Exploitation is network-based and requires no privileges or user interaction, but attack complexity is high because the attacker must shape specific traffic conditions to trigger the leak.

Root Cause

The root cause is improper handling of sensitive data within the SignIn subsystem, as tracked in Chromium Issue #513608831. Chrome fails to fully constrain what information the SignIn flow exposes when processing attacker-influenced network responses. Because the Chromium bug remains restricted pending broad patch adoption, Google has not disclosed low-level implementation details of the leak path.

Attack Vector

An attacker positioned to deliver or influence network traffic to a victim browser, such as an on-path adversary or a controlled remote endpoint, crafts responses that interact with Chrome's SignIn flow. The victim only needs to use the browser normally; no click or credential entry is required beyond typical sign-in activity. Successful exploitation discloses confidential data handled by the SignIn component but does not modify browser state or execute code. See the Chrome Stable channel update for the fixed build. No verified exploit code is publicly available.

Detection Methods for CVE-2026-79122

Indicators of Compromise

Chrome browser processes running builds earlier than 152.0.7977.65 on managed endpoints
Anomalous outbound TLS sessions from Chrome to non-Google hosts during Google account sign-in flows
Unexpected HTTP/HTTPS responses interacting with Chrome SignIn endpoints from untrusted network paths

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65 for remediation
Correlate browser telemetry with proxy logs to identify SignIn-related traffic terminating at unexpected domains or IPs
Alert on man-in-the-middle indicators such as certificate anomalies or downgraded TLS on paths used for authentication

Monitoring Recommendations

Enforce browser version reporting through enterprise management tooling and dashboard the patch gap for CVE-2026-79122
Monitor DNS and TLS SNI records for sign-in-related hostnames reached from outdated Chrome clients
Retain browser and network telemetry in a centralized data lake to support retrospective hunts once further technical details are released

How to Mitigate CVE-2026-79122

Immediate Actions Required

Update all Chrome installations to version 152.0.7977.65 or later on Windows, macOS, and Linux
Trigger a managed browser restart to ensure the patched binary is loaded across user sessions
Verify Chromium-based third-party browsers have picked up the corresponding upstream fix before considering the risk closed

Patch Information

Google addressed CVE-2026-79122 in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. The fixed version is 152.0.7977.65. Administrators should confirm rollout through enterprise policy and the chrome://settings/help version check, and validate that automatic updates are enabled on unmanaged endpoints.

Workarounds

Restrict browser network paths through inspected corporate proxies to reduce exposure to attacker-controlled traffic
Enforce strict TLS validation and certificate pinning where supported to limit on-path manipulation of SignIn traffic
Where patching is delayed, discourage use of Chrome sign-in features on untrusted networks until the update is applied

bash

# Verify installed Chrome version meets the fixed build
google-chrome --version | awk '{print $3}'
# Expected output: 152.0.7977.65 or later